Description
An authentication bypass vulnerability exists in AVTECH IP camera, DVR, and NVR devices’ streamd web server. The strstr() function is used to identify ".cab" requests, allowing any URL containing ".cab" to bypass authentication and access protected endpoints.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
AVTECH IP camera, DVR, and NVR devices
Default version status: unaffected
1000-1000-1000-1000affected1000C-1000C-1000C-1000Caffected1001-1000-1000-1000affected1001-1001-1000-1000affected1002-1000-1000-1000affected1002-1002-1000-1002affected1002D-1000D-1000D-1000Daffected1003-1000-1000-1001affected1003-1001-1001-1000affected1003-1002-1001-1000affected1004-1000-1000-1000affected1004-1001-1001-1001affected1004-1003-1001-1002affected1004-1003-1002-1001affected1004A-1001A-1002A-1000Aaffected1005-1002-1001-1002affected1005-1003-1001-1002affected1005-1004-1002-1001affected1005A-1001A-1002A-1001Aaffected1005D-1001D-1002D-1001Daffected1006-1002-1001-1002affected1006-1004-1003-1001affected1007-1001-1003-1001affected1007-1001-1004-1003affected1007-1002-1001-1003affected1007-1002-1003-1002affected1007-1004-1003-1001affected1008-1001-1003-1002affected1008-1004-1004-1001affected1008D-1003D-1004D-1002Daffected1008J-1004J-1004J-1001Jaffected1009-1001-1004-1001affected1009-1002-1005-1003affected1009-1003-1005-1002affected1010-1001-1004-1001affected1010-1001-1004-1002affected1010-1003-1005-1002affected1010-1003-1006-1003affected1010-1003-1006-1004affected1010-1004-1007-1001affected1010J-1001J-1004J-1001Jaffected1010N-1003N-1005N-1002Naffected1011-1001-1002A-1002affected1011-1001-1002D-1002affected1011-1001-1003-1002affected1011-1001-1004-1002affected1011-1001-1005-1002affected1011-1004-1005-1002affected1012-1001-1005-1002affected1012-1001-1005-1003affected1012-1001-1005PO-1002affected1012-1003-1007-1002affected1012-1003-1007-1004affected1013-1001-1005-1003affected1013-1002-1006-1002affected1013-1003-1008-1003affected1013-1004-1008-1004affected1013-1005-1005-1002affected1013-1005-1007-1002affected1013K-1005K-1007PO-1002Kaffected1014-1002-1006-1002affected1014-1002-1006-1003affected1014-1003-1008-1003affected1014-1005-1008-1002affected1014B-1002B-1006B-1002Baffected1015-1001-1006-1003affected1015-1002-1006-1003affected1015-1002-1007-1002affected1015-1003-1008-1003affected1015-1005-1009-1004affected1015-1006-1004-1002affected1015-1006-1005-1002affected1015-1006-1008-1002affected1015C-1004C-1003C-1005Caffected1015K-1006K-1008PO-1002Kaffected1016-1002-1007-1002affected1016-1006-1013-1002affected1016-1007-1009-1003affected1016-1007-1011-1003affected1017-1002-1007-1003affected1017-1003-1007-1003affected1017-1003-1009-1003affected1017-1005-1004-1005affected1017-1006-1013-1002affected1017-1013-1014-1005affected1018-1003-1005-1004affected1018-1003-1008-1003affected1018-1003-1008-1004affected1018-1003-1008PO-1003affected1018-1004-1005-1005affected1018-1007-1009-1003affected1018-1012-1011-1010affected1019-1004-1006-1005affected1019-1007-1009-1003affected1020-1003-1008-1003affected1020-1003-1008-1004affected1020-1004-1007-1006affected1020-1007-1008-1003affected1020-1007-1009-1003affected1021-1003-1008-1003affected1021-1003-1008-1004affected1021-1005-1006-1005affected1021-1005-1008-1006affected1021-1006-1015-1002affected1021-1007-1010-1003affected1022-1005-1007-1005affected1022-1005-1009-1007affected1022-1006-1015-1002affected1022-1013-1014-1010affected1022-1014-1016-1002-FFFFaffected1022Y-1014Y-1016Y-1002Y-FFFFaffected1023-1005-1008-1006affected1023-1007-1016-1003affected1024-1019-1019-1007affected1025-1006-1010-1007affected1025-1017-1017-1011affected1027-1007-1019-1003affected1027-1021-1021-1008affected1028-1021-1022-1008affected1031-1007-1022-1003affected1032-1022-1024-1008affected1033-1018-1021-1012affected1035-1005-1005-1004affected1035-1005-1005-1005affected1035-1005-1005-1005Paffected1035-1007-1024-1003affected1035-1024-1025-1008affected1036-1005-1006-1005affected1036-1007-1024-1003affected1036-1014-1016-1016affected1037-1024-1027-1008affected1037-1025-1027-1008affected1038-1021-1024-1012affected1038-1021-1024-1012-A5affected1038-1025-1028-1008affected1039-1005-1008-1004affected1039-1005-1008-1005affected1039-1014-1017-1016affected1039D-1014D-1017D-1016Daffected1040-1026-1029-1008affected1041-1005-1009-1005affected1042-1026-1030-1008affected1044-1026-1030-1008affected1044-1026-1031-1008affected1045-1015-1020-1018affected1046-1027-1032-1008affected1047-1027-1031-1008affected1049-1027-1033-1008affected1050-1027-1034-1008affected1050-1027-1036-1008affected1051-1027-1035-1008affected1051CZ-1028-1037-1008affected1052-1027-1034-1008affected1052-1028-1038-1008affected1052A-1028-1038A-1008affected1054-1027-1036-1008affected1054-1028-1036-1008affected1055-1028-1036-1008affected1056-1028-1037-1008affected1058-1028-1039-1008affected1062-1028-1041-1008affected1065-1029-1043-1008affected1068-1029-1043-1008affected1069-1029-1043-1008affected1071-1029-1044-1008affected1077-1017-1035-1007affected1077-1017-1035-1007-A6affected1077-1017-1035-1007-D4affected1077-1017-1035-1007-D705FFaffected1078-1017-1036-1007affected1078-1017-1036-1007-A6affected1078-1017-1036-1007-D707FFaffected1079-1017-1037-1007affected1079-1017-1037-1007-D4affected1W77-1W17-1W35-1W07-A6affectedA077-1017-A035-1007affectedA077-1017-A035-1007-A6affectedA1035-1024-A1025-1008affectedA1038-1025-A1028-1008-D4affectedS681-S681-S681-S681affectedS749-S749-S749-S749affectedS818-S818-S818-S818affectedS820-S820-S820-S820affectedS823-S823-S823-S823affectedS914V-S914V-S914V-S914VaffectedS984-S984-S984-S984affected
References
- https://www.exploit-db.com/exploits/40500 ↗
- https://avtech.com/ ↗
- https://web.archive.org/web/20240810225729/https://www.search-lab.hu/advisories/126-AVTech-devices-multiple-vulnerabilities ↗
- https://web.archive.org/web/20161029201749/https://github.com/ebux/AVTECH ↗
- https://vulncheck.com/advisories/avtech-ipcamera-nvr-dvr-mulitple-vulns ↗