Description
An authentication bypass vulnerability exists in AVTECH IP camera, DVR, and NVR devices’ streamd web server. The strstr() function allows unauthenticated access to any request containing "/nobody" in the URL, bypassing login controls.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
AVTECH IP camera, DVR, and NVR Devices
Default version status: unaffected
1000-1000-1000-1000affected1000C-1000C-1000C-1000Caffected1001-1000-1000-1000affected1001-1001-1000-1000affected1002-1000-1000-1000affected1002-1002-1000-1002affected1002D-1000D-1000D-1000Daffected1003-1000-1000-1001affected1003-1001-1001-1000affected1003-1002-1001-1000affected1004-1000-1000-1000affected1004-1001-1001-1001affected1004-1002-1000-1001affected1004-1003-1001-1002affected1004-1003-1002-1001affected1004A-1001A-1002A-1000Aaffected1005-1002-1001-1002affected1005-1003-1001-1002affected1005-1004-1002-1001affected1005A-1001A-1002A-1001Aaffected1005D-1001D-1002D-1001Daffected1006-1002-1001-1002affected1006-1003-1001-1001affected1006-1004-1003-1001affected1007-1001-1003-1001affected1007-1001-1004-1003affected1007-1002-1001-1000affected1007-1002-1001-1003affected1007-1002-1003-1002affected1007-1004-1003-1001affected1008-1001-1003-1002affected1008-1004-1004-1001affected1008D-1003D-1004D-1002Daffected1008J-1004J-1004J-1001Jaffected1009-1001-1004-1001affected1009-1002-1005-1003affected1009-1003-1001-1003affected1009-1003-1005-1002affected1010-1001-1004-1001affected1010-1001-1004-1002affected1010-1003-1005-1002affected1010-1003-1006-1003affected1010-1003-1006-1004affected1010-1004-1007-1001affected1010J-1001J-1004J-1001Jaffected1010N-1003N-1005N-1002Naffected1011-1001-1002A-1002affected1011-1001-1002D-1002affected1011-1001-1003-1002affected1011-1001-1004-1002affected1011-1001-1005-1002affected1011-1004-1005-1002affected
References
- https://www.exploit-db.com/exploits/40500 ↗
- https://avtech.com/ ↗
- https://web.archive.org/web/20240810225729/https://www.search-lab.hu/advisories/126-AVTech-devices-multiple-vulnerabilities ↗
- https://web.archive.org/web/20161029201749/https://github.com/ebux/AVTECH ↗
- https://vulncheck.com/advisories/avtech-ipcamera-nvr-dvr-mulitple-vulns ↗