CVE-2013-1391
HIGHHunt CCTV DVR Firmware - Unauthenticated Configuration Disclosure
Title source: llmExploitation Summary
EIP tracks 2 public exploits for CVE-2013-1391.
PoCs published by Alejandro Ramos, Alejandro Ramos, juan vazquez, including Metasploit module auxiliary/scanner/misc/dvr_config_disclosure.
AI-analyzed exploit summary The exploit demonstrates a remote information-disclosure vulnerability in Hunt CCTV devices by fetching the DVR.cfg file via a simple HTTP request, which contains sensitive credentials. The provided curl command retrieves and parses the configuration file to extract user credentials.
Description
Authentication bypass vulnerability in the the web interface in Hunt CCTV, Capture CCTV, Hachi CCTV, NoVus CCTV, and Well-Vision Inc DVR systems allows a remote attacker to retrieve the device configuration.
Exploits (2)
The exploit demonstrates a remote information-disclosure vulnerability in Hunt CCTV devices by fetching the DVR.cfg file via a simple HTTP request, which contains sensitive credentials. The provided curl command retrieves and parses the configuration file to extract user credentials.
This Metasploit module exploits an authentication bypass vulnerability in multiple DVR manufacturers' web interfaces to retrieve device configuration files, including credentials for PPPoE, DDNS, FTP, and DVR users.
References (3)
Scores
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N