A vulnerability classified as critical has been found in Loftek Nexus 543 IP Camera (Network Camera Software) (unknown version). This affects an unknown code block of the file check_users.cgi. The manipulation as part of a HTTP GET Request leads to a insufficiently protected credentials vulnerability (Password). CWE is classifying the issue as CWE-522. The product transmits or stores authentication credentials, but it uses an insecure method that is susceptible to unauthorized interception and/or retrieval. This is going to have an impact on confidentiality. The summary by CVE is:

The Loftek Nexus 543 IP Camera stores passwords in cleartext, which allows remote attackers to obtain sensitive information via an HTTP GET request to check_users.cgi. NOTE: cleartext passwords can also be obtained from proc/kcore when leveraging the directory traversal vulnerability in CVE-2013-3311.

The weakness was published 11/21/2019 by Craig Young. This vulnerability is uniquely identified as CVE-2013-3313 since 04/30/2013. It is possible to initiate the attack remotely. No form of authentication is needed for exploitation. Technical details are known, but no exploit is available. MITRE ATT&CK project uses the attack technique T1552 for this issue.

Applying a patch is able to eliminate this problem.

Similar entries are available at 146026, 146024 and 146023.

Productinfo

Type

• Network Camera Software

Vendor

• Loftek

Name

• Nexus 543 IP Camera

CPE 2.3info

• 🔍

CPE 2.2info

• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Discussion