/Vulnerability Library

BEWARD N100 H.264 VGA IP Camera M2.1.6 - Arbitrary File Disclosure

CVE-2019-25246
Verified

Description

Beward N100 H.264 VGA IP Camera M2.1.6 contains an authenticated file disclosure vulnerability caused by improper validation of the 'READ.filePath' parameter in fileread script and SendCGICMD API, letting authenticated attackers read arbitrary system files.

Severity

High

CVSS Score

8.6

Exploit Probability

19%

Affected Product

n100_h.264_vga_ip_camera

Published Date

August 16, 2021

Template Author

geeknik, liangtovi-debug

CVE-2019-25246.yaml
8.6Score

CVSS Metrics

CVSS Vector:
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
CVE ID:
cve-2019-25246
CWE ID:
cwe-22, cwe-73

References

https://www.exploit-db.com/exploits/46320https://www.zeroscience.mk/en/vulnerabilities/ZSL-2019-5511.phphttps://nvd.nist.gov/vuln/detail/CVE-2019-25246

Remediation Steps

Update to the latest version or apply vendor patches addressing this vulnerability