CVE-2018-12675

MEDIUMNuclei

SV3C HD Camera L Series - Open Redirect

Title source: github.com
STIX 2.1 vulnerability

Record summary

CVE-2018-12675 has a selected CVSS score of 6.1 (medium); EIP currently links 1 Nuclei template.

Description

The SV3C HD Camera (L-SERIES V2.3.4.2103-S50-NTD-B20170508B and V2.3.4.2103-S50-NTD-B20170823B) does not perform origin checks on URLs that the camera's web interface redirects a user to. This can be leveraged to send a user to an unexpected endpoint.

Description source: CVE List

Exploitation context

Available material

Nuclei templates
1

Nuclei templates

1
ProjectDiscoveryMEDIUMSV3C HD Camera L Series - Open RedirectCVSS 6.1

SV3C HD Camera L Series 2.3.4.2103-S50-NTD-B20170508B and 2.3.4.2103-S50-NTD-B20170823B contains an open redirect vulnerability. It does not perform origin checks on URLs in the camera's web interface, which can be leveraged to send a user to an unexpected endpoint. An attacker can possibly obtain sensitive information, modify data, and/or execute unauthorized operations.

Impact

An attacker can use this vulnerability to redirect users to malicious websites, leading to phishing attacks.

Remediation

Apply the latest firmware update provided by the vendor to fix the open redirect vulnerability.

WeaknessesCWE-601
Authors0x_Akoko
Template tagscvecve2018redirectsv3ccameraiotvuln
CVSS vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CPE: cpe:2.3:o:sv3c:h.264_poe_ip_camera_firmware:v2.3.4.2103-s50-ntd-b20170508b:*:*:*:*:*:*:*
https://bishopfox.com/blog/sv3c-l-series-hd-camera-advisory https://vuldb.com/?id.125799 https://www.bishopfox.com/news/2018/10/sv3c-l-series-hd-camera-multiple-vulnerabilities/ https://nvd.nist.gov/vuln/detail/CVE-2018-12675 https://github.com/ARPSyndicate/kenzer-templates

Source: ProjectDiscovery

References

2