CVE-2018-10770

download.rsp on ShenZhen Anni "5 in 1 XVR" devices allows remote attackers to download the configuration (without a login) to discover the password.

Score

CVSS 3.0 9.8 Critical

Status

Modified - cve@mitre.org

Published

2018-05-09

Last modified

2024-08-05

Weaknesses

CWE-200

Affected products

• 5 In 1 Xvr Firmware (Annigroup)

References

• https://github.com/D0neMkj/EXP_IOT/blob/master/CAMERA/XVR_camera/readme
• https://github.com/D0neMkj/EXP_IOT/tree/master/CAMERA/XVR_camera