| 标题 | Mercury MNVR816 Video Recorder 2.0.1.0.5 File and Directory Information Exposure |
|---|
| 描述 |
# An unauthenticated web interface in Mercury-MNVR816 Video Recorder
## Overview
* Type: Information leak
* Supplier: Mercury
* Victim URL: http://192.168.1.240/web-static/
* Product: MNVR816
* Affect version: (lastest) 2.0.1.0.5
* Firmware download: https://service.mercurycom.com.cn/download-2582.html
## Description
An unauthenticated web interface is able to leak local files of the affected video recorder devices. Without any permission, attackers can get sensitive information about the device from the victim URL.
The victim URL is a hidden interface and hasn't been protected by any authentication and authorization.
## Business Impact
The unauthenticated web interface could lead to serious damage. Thus the vulnerability is very dangerous which could also result in reputational damage for the business through the impact on customers' trust.
## Steps to Reproduce
Visit the victim URL from the web, and you can browse the local files without any permission.
|
|---|
| 用户 | leetmoon (UID 42673) |
|---|
| 提交 | 2024-09-02 09時28分 (2 年前) |
|---|
| 管理 | 2024-09-10 15時11分 (8 days later) |
|---|
| 状态 | 已接受 |
|---|
| VulDB条目 | 276963 [Mercury MNVR816 直到 2.0.1.0.5 /web-static/ 权限提升] |
|---|
| 积分 | 17 |
|---|