CVE-2013-1391 : Authentication bypass vulnerability in the the web interface in Hunt CCTV, Captu

Authentication bypass vulnerability in the the web interface in Hunt CCTV, Capture CCTV, Hachi CCTV, NoVus CCTV, and Well-Vision Inc DVR systems allows a remote attacker to retrieve the device configuration.

Published 2019-10-30 21:15:12

Updated 2019-11-05 16:33:55

Source MITRE

View at NVD, CVE.org

Vulnerability category: BypassGain privilege

Products affected by CVE-2013-1391

Huntcctv » Dvr-04ch Firmware » Version: N/A
cpe:2.3:o:huntcctv:dvr-04ch_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Huntcctv » Dvr-04ch » Version: N/A
Huntcctv » Dvr-04nc Firmware » Version: N/A
cpe:2.3:o:huntcctv:dvr-04nc_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Huntcctv » Dvr-04nc » Version: N/A
Huntcctv » Dvr-08ch Firmware » Version: N/A
cpe:2.3:o:huntcctv:dvr-08ch_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Huntcctv » Dvr-08ch » Version: N/A
Huntcctv » Dvr-08nc Firmware » Version: N/A
cpe:2.3:o:huntcctv:dvr-08nc_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Huntcctv » Dvr-08nc » Version: N/A
Huntcctv » Dvr-16ch Firmware » Version: N/A
cpe:2.3:o:huntcctv:dvr-16ch_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Huntcctv » Dvr-16ch » Version: N/A
Huntcctv » Dr6-704a4h Firmware » Version: N/A
cpe:2.3:o:huntcctv:dr6-704a4h_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Huntcctv » Dr6-704a4h » Version: N/A
Huntcctv » Dr6-708a4h Firmware » Version: N/A
cpe:2.3:o:huntcctv:dr6-708a4h_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Huntcctv » Dr6-708a4h » Version: N/A
Huntcctv » Dr6-7316a4h Firmware » Version: N/A
cpe:2.3:o:huntcctv:dr6-7316a4h_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Huntcctv » Dr6-7316a4h » Version: N/A
Huntcctv » Dr6-7316a4hl Firmware » Version: N/A
cpe:2.3:o:huntcctv:dr6-7316a4hl_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Huntcctv » Dr6-7316a4hl » Version: N/A
Huntcctv » Hdr-04kd Firmware » Version: N/A
cpe:2.3:o:huntcctv:hdr-04kd_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Huntcctv » Hdr-04kd » Version: N/A
Huntcctv » Hdr-08kd Firmware » Version: N/A
cpe:2.3:o:huntcctv:hdr-08kd_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Huntcctv » Hdr-08kd » Version: N/A
Capturecctv » Cdr 0410ve Firmware » Version: N/A
cpe:2.3:o:capturecctv:cdr_0410ve_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Capturecctv » Cdr 0410ve » Version: N/A
Capturecctv » Cdr 0820vde Firmware » Version: N/A
cpe:2.3:o:capturecctv:cdr_0820vde_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Capturecctv » Cdr 0820vde » Version: N/A
Hachi » Hv-04rd Pro Firmware » Version: N/A
cpe:2.3:o:hachi:hv-04rd_pro_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Hachi » Hv-04rd Pro » Version: N/A
Hachi » Hv-08rd Pro Firmware » Version: N/A
cpe:2.3:o:hachi:hv-08rd_pro_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Hachi » Hv-08rd Pro » Version: N/A
Novuscctv » Nv-dvr1204 Firmware » Version: N/A
cpe:2.3:o:novuscctv:nv-dvr1204_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Novuscctv » Nv-dvr1204 » Version: N/A
Novuscctv » Nv-dvr1208 Firmware » Version: N/A
cpe:2.3:o:novuscctv:nv-dvr1208_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Novuscctv » Nv-dvr1208 » Version: N/A
Novuscctv » Nv-dvr1216 Firmware » Version: N/A
cpe:2.3:o:novuscctv:nv-dvr1216_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Novuscctv » Nv-dvr1216 » Version: N/A
VSP » Tw-dvr604 Firmware » Version: N/A
cpe:2.3:o:vsp:tw-dvr604_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: VSP » Tw-dvr604 » Version: N/A
VSP » Tw-dvr616 Firmware » Version: N/A
cpe:2.3:o:vsp:tw-dvr616_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: VSP » Tw-dvr616 » Version: N/A

Exploit prediction scoring system (EPSS) score for CVE-2013-1391

EPSS FAQ

97.01%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 100 %

Percentile, the proportion of vulnerabilities that are scored at or less

Metasploit modules for CVE-2013-1391

Multiple DVR Manufacturers Configuration Disclosure

First seen: 2020-04-26

auxiliary/scanner/misc/dvr_config_disclosure

This module takes advantage of an authentication bypass vulnerability at the web interface of multiple manufacturers DVR systems, which allows to retrieve the device configuration. Authors: - Alejandro Ramos - juan vazquez <juan.vazquez@metasploit.com>

More information

CVSS scores for CVE-2013-1391

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
5.0	MEDIUM	AV:N/AC:L/Au:N/C:P/I:N/A:N	10.0	2.9	NIST
Access Vector: Network Access Complexity: Low Authentication: None Confidentiality Impact: Partial Integrity Impact: None Availability Impact: None
7.5	HIGH	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N	3.9	3.6	NIST
Attack Vector: Network Attack Complexity: Low Privileges Required: None User Interaction: None Scope: Unchanged Confidentiality: High Integrity: None Availability: None

CWE ids for CVE-2013-1391

CWE-287 Improper Authentication

When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.

Assigned by: nvd@nist.gov (Primary)

References for CVE-2013-1391

http://www.securitybydefault.com/2013/01/12000-grabadores-de-video-expuestos-en.html

12.000 grabadores de video expuestos en Internet ~ Security By Default
Exploit;Third Party Advisory
https://www.rapid7.com/db/modules/auxiliary/scanner/misc/dvr_config_disclosure

Multiple DVR Manufacturers Configuration Disclosure
Third Party Advisory
https://www.securityfocus.com/bid/57579/info

Multiple Hunt CCTV Information Disclosure Vulnerability
Exploit;Third Party Advisory;VDB Entry

Jump to