Vulnerability Details : CVE-2013-2572

A Security Bypass vulnerability exists in TP-LINK IP Cameras TL-SC 3130, TL-SC 3130G, 3171G, 4171G, and 3130 1.6.18P12 due to default hard-coded credentials for the administrative Web interface, which could let a malicious user obtain unauthorized access to CGI files.

Vulnerability category: Bypass

Published 2020-01-29 19:15:12

Updated 2020-01-31 18:33:11

Source MITRE

View at NVD, CVE.org

Exploit prediction scoring system (EPSS) score for CVE-2013-2572

Probability of exploitation activity in the next 30 days: 5.84%

Percentile, the proportion of vulnerabilities that are scored at or less: ~ 92 % EPSS Score History EPSS FAQ

CVSS scores for CVE-2013-2572

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Source
5.0	MEDIUM	AV:N/AC:L/Au:N/C:P/I:N/A:N	10.0	2.9	nvd@nist.gov
Access Vector: Network Access Complexity: Low Authentication: None Confidentiality Impact: Partial Integrity Impact: None Availability Impact: None
7.5	HIGH	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N	3.9	3.6	nvd@nist.gov
Attack Vector: Network Attack Complexity: Low Privileges Required: None User Interaction: None Scope: Unchanged Confidentiality: High Integrity: None Availability: None

CWE ids for CVE-2013-2572

CWE-798 Use of Hard-coded Credentials

The product contains hard-coded credentials, such as a password or cryptographic key, which it uses for its own inbound authentication, outbound communication to external components, or encryption of internal data.

Assigned by: nvd@nist.gov (Primary)

References for CVE-2013-2572

http://www.securityfocus.com/bid/60194

Malformed Request
Third Party Advisory;VDB Entry
https://exchange.xforce.ibmcloud.com/vulnerabilities/84573

TP-Link IP camera default account CVE-2013-2572 Vulnerability Report
Third Party Advisory;VDB Entry
https://www.coresecurity.com/advisories/tp-link-ip-cameras-multiple-vulnerabilities

TP-Link IP Cameras Multiple Vulnerabilities | Core Security
Exploit;Patch;Third Party Advisory
https://packetstormsecurity.com/files/cve/CVE-2013-2572

CVE-2013-2572 ≈ Packet Storm
Third Party Advisory;VDB Entry
http://www.exploit-db.com/exploits/25812

TP-Link IP Cameras Firmware 1.6.18P12 - Multiple Vulnerabilities - Hardware webapps Exploit
Exploit;Patch;Third Party Advisory;VDB Entry

Products affected by CVE-2013-2572

Tp-link » Tl-sc 3130g Firmware
Versions up to, including, (<=) 1.6.18p12
cpe:2.3:o:tp-link:tl-sc_3130g_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Tp-link » Tl-sc 3130g » Version: N/A
Tp-link » Tl-sc 3171g Firmware
Versions up to, including, (<=) 1.6.18p12
cpe:2.3:o:tp-link:tl-sc_3171g_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Tp-link » Tl-sc 3171g » Version: N/A
Tp-link » Tl-sc 4171g Firmware
Versions up to, including, (<=) 1.6.18p12
cpe:2.3:o:tp-link:tl-sc_4171g_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Tp-link » Tl-sc 4171g » Version: N/A
Tp-link » Tl-sc 3130 Firmware
Versions up to, including, (<=) 1.6.18p12
cpe:2.3:o:tp-link:tl-sc_3130_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Tp-link » Tl-sc 3130 » Version: N/A