Description
Arteco Web Client DVR/NVR contains a session hijacking vulnerability with insufficient session ID complexity that allows remote attackers to bypass authentication. Attackers can brute force session IDs within a specific numeric range to obtain valid sessions and access live camera streams without authorization.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Arteco-Global Arteco Web Client DVR/NVR
Unknownaffected
References
- https://www.exploit-db.com/exploits/49348 ↗
- https://www.arteco-global.com ↗
- https://www.zeroscience.mk/en/vulnerabilities/ZSL-2020-5613.php ↗
- https://packetstorm.news/files/id/160718 ↗
- https://exchange.xforce.ibmcloud.com/vulnerabilities/193750 ↗
- https://exchange.xforce.ibmcloud.com/vulnerabilities/194139 ↗
- https://cxsecurity.com/issue/WLB-2020120170 ↗
- https://www.vulncheck.com/advisories/arteco-web-client-dvrnvr-session-id-brute-force-authentication-bypass ↗