AvertX HD438/HD838 weak password

Summaryinfo

A vulnerability classified as critical has been found in AvertX HD438 and HD838. Impacted is an unknown function. Performing a manipulation results in weak password. This vulnerability is known as CVE-2020-11624. Remote exploitation of the attack is possible. No exploit is available.

Detailsinfo

A vulnerability was found in AvertX HD438 and HD838 (version now known). It has been classified as problematic. This affects some unknown processing. The manipulation with an unknown input leads to a weak password vulnerability. CWE is classifying the issue as CWE-521. The product does not require that users should have strong passwords, which makes it easier for attackers to compromise user accounts. This is going to have an impact on confidentiality. The summary by CVE is:

An issue was discovered in AvertX Auto focus Night Vision HD Indoor/Outdoor IP Dome Camera HD838 and Night Vision HD Indoor/Outdoor Mini IP Bullet Camera HD438. They do not require users to change the default password for the admin account. They only show a pop-up window suggesting a change but there's no enforcement. An administrator can click Cancel and proceed to use the device without changing the password. Additionally, they disclose the default username within the login.js script. Since many attacks for IoT devices, including malware and exploits, are based on the usage of default credentials, it makes these cameras an easy target for malicious actors.

The weakness was published 07/23/2020. This vulnerability is uniquely identified as CVE-2020-11624 since 04/07/2020. The exploitability is told to be difficult. It is possible to initiate the attack remotely. No form of authentication is needed for exploitation. The technical details are unknown and an exploit is not publicly available. The attack technique deployed by this issue is T1552 according to MITRE ATT&CK.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

Similar entries are available at VDB-158956 and VDB-158954. Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Vendor

• AvertX

Name

• HD438
• HD838

CPE 2.3info

• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion