Exploitation Summary
EIP tracks 1 public exploit for CVE-2013-3585.
AI-analyzed exploit summary The exploit demonstrates an authentication bypass vulnerability in Samsung DVR firmware <= 1.10 by sending a crafted HTTP request with an arbitrary cookie to access protected CGI endpoints. It includes functional Python code to dump user credentials from the device.
Description
Samsung Web Viewer for Samsung DVR devices stores credentials in cleartext, which allows context-dependent attackers to obtain sensitive information via vectors involving (1) direct access to a file or (2) the user-setup web page.
Exploits (1)
The exploit demonstrates an authentication bypass vulnerability in Samsung DVR firmware <= 1.10 by sending a crafted HTTP request with an arbitrary cookie to access protected CGI endpoints. It includes functional Python code to dump user credentials from the device.