| शीर्षक | Mercury MNVR816 Video Recorder 2.0.1.0.5 File and Directory Information Exposure |
|---|
| विवरण |
# An unauthenticated web interface in Mercury-MNVR816 Video Recorder
## Overview
* Type: Information leak
* Supplier: Mercury
* Victim URL: http://192.168.1.240/web-static/
* Product: MNVR816
* Affect version: (lastest) 2.0.1.0.5
* Firmware download: https://service.mercurycom.com.cn/download-2582.html
## Description
An unauthenticated web interface is able to leak local files of the affected video recorder devices. Without any permission, attackers can get sensitive information about the device from the victim URL.
The victim URL is a hidden interface and hasn't been protected by any authentication and authorization.
## Business Impact
The unauthenticated web interface could lead to serious damage. Thus the vulnerability is very dangerous which could also result in reputational damage for the business through the impact on customers' trust.
## Steps to Reproduce
Visit the victim URL from the web, and you can browse the local files without any permission.
|
|---|
| उपयोगकर्ता | leetmoon (UID 42673) |
|---|
| सबमिशन | 02/09/2024 09:28 AM (2 साल पहले) |
|---|
| संयम | 10/09/2024 03:11 PM (8 days later) |
|---|
| स्थिति | स्वीकृत |
|---|
| VulDB प्रविष्टि | 276963 [Mercury MNVR816 तक 2.0.1.0.5 /web-static/ अधिकार वृद्धि] |
|---|
| अंक | 17 |
|---|