Beward N100 H.264 VGA IP Camera M2.1.6.04C014 READ.filePath path traversal

Summaryinfo

A vulnerability classified as critical has been found in Beward N100 H.264 VGA IP Camera M2.1.6.04C014. This affects an unknown part. The manipulation of the argument READ.filePath leads to path traversal. This vulnerability is documented as CVE-2019-25246. The attack can be initiated remotely. Additionally, an exploit exists.

Detailsinfo

A vulnerability was found in Beward N100 H.264 VGA IP Camera M2.1.6.04C014 and classified as problematic. This issue affects some unknown processing. The manipulation of the argument READ.filePath with an unknown input leads to a path traversal vulnerability. Using CWE to declare the problem leads to CWE-22. The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory. Impacted is confidentiality. The summary by CVE is:

Beward N100 H.264 VGA IP Camera M2.1.6 contains an authenticated file disclosure vulnerability that allows attackers to read arbitrary system files via the 'READ.filePath' parameter. Attackers can exploit the fileread script or SendCGICMD API to access sensitive files like /etc/passwd and /etc/issue by supplying absolute file paths.

The weakness was released by Gjoko Krstic as 46320. It is possible to read the advisory at exploit-db.com. The identification of this vulnerability is CVE-2019-25246 since 12/24/2025. The exploitation is known to be easy. The attack may be initiated remotely. Technical details as well as a public exploit are known. The attack technique deployed by this issue is T1006 according to MITRE ATT&CK.

The exploit is available at exploit-db.com. It is declared as proof-of-concept.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

The vulnerability is also documented in the databases at Exploit-DB (46320) and EUVD (EUVD-2025-205317). Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Type

• Network Camera Software

Vendor

• Beward

Name

• N100 H.264 VGA IP Camera

Version

• M2.1.6.04C014

CPE 2.3info

• 🔒

CPE 2.2info

• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion