Lucene search

Rapid7CVE-2018-5560

HistoryJan 31, 2019 - 9:29 p.m.

CVE-2018-5560

2019-01-3121:29:00

CWE-798

rapid7

web.nvd.nist.gov

cve-2018-5560

practecol

guardzilla

cloud-based storage

credential

vulnerability

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:N/C:P/I:N/A:N

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N

AI Score

7.3

Confidence

High

EPSS

0.007

Percentile

80.7%

JSON

A reliance on a static, hard-coded credential in the design of the cloud-based storage system of Practecol’s Guardzilla All-In-One Video Security System allows an attacker to view the private data of all users of the Guardzilla device.

Affected configurations

Nvd

Node

guardzillagz521w_firmware

AND

guardzillagz521wMatch-

VendorProductVersionCPE
guardzillagz521w_firmware*cpe:2.3:o:guardzilla:gz521w_firmware:*:*:*:*:*:*:*:*
guardzillagz521w-cpe:2.3:h:guardzilla:gz521w:-:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
guardzilla	gz521w_firmware	*	cpe:2.3:o:guardzilla:gz521w_firmware::::::::
guardzilla	gz521w	-	cpe:2.3:h:guardzilla:gz521w:-:::::::*

CNA Affected

[
  {
    "product": "Guardzilla All-In-One Video Security System",
    "vendor": "Practecol, LLC",
    "versions": [
      {
        "status": "affected",
        "version": "2018"
      }
    ]
  }
]

References

blog.rapid7.com/2018/12/27/r7-2018-52-guardzilla-iot-video-camera-hard-coded-credential-cve-2018-5560/

www.0dayallday.org/guardzilla-video-camera-hard-coded-aws-credentials/

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:N/C:P/I:N/A:N

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N

AI Score

7.3

Confidence

High

EPSS

0.007

Percentile

80.7%

JSON

Related for CVE-2018-5560