Code injection

2020-05-2813:15:00

PRIOn knowledge base

www.prio-n.com

6.3 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

28.6%

JSON

testserver.cgi of the web service on VIVOTEK Network Cameras before XXXXX-VVTK-2.2002.xx.01x (and before XXXXX-VVTK-0XXXX_Beta2) allows an authenticated user to obtain arbitrary files from a camera’s local filesystem. For example, this affects IT9388-HT devices.

CPENameOperatorVersion
cc8160\\(hs\\)_firmwareeq<= 113b
cc8160_firmwareeq<= 113b
cc8370-hv_firmwareeq<= 213b
cc8371-hv_firmwareeq<= 113b
cc9381-hv_firmwareeq<= 222g
cd8371-hntv_firmwareeq<= 113b
cd8371-hnvf2_firmwareeq<= 113b
fd8166a-n_firmwareeq<= 113b
fd8166a_firmwareeq<= 213b
fd8167a_firmwareeq<= 213b

Name	Operator	Version
cc8160\\(hs\\)_firmware	eq	<= 113b
cc8160_firmware	eq	<= 113b
cc8370-hv_firmware	eq	<= 213b
cc8371-hv_firmware	eq	<= 113b
cc9381-hv_firmware	eq	<= 222g
cd8371-hntv_firmware	eq	<= 113b
cd8371-hnvf2_firmware	eq	<= 113b
fd8166a-n_firmware	eq	<= 113b
fd8166a_firmware	eq	<= 213b
fd8167a_firmware	eq	<= 213b