CVSS: 7.5EPSS: 0%CPEs: 38EXPL: 1CVE-2018-18441
https://notcve.org/view.php?id=CVE-2018-18441
D-Link DCS series Wi-Fi cameras expose sensitive information regarding the device configuration. The affected devices include many of DCS series, such as: DCS-936L, DCS-942L, DCS-8000LH, DCS-942LB1, DCS-5222L, DCS-825L, DCS-2630L, DCS-820L, DCS-855L, DCS-2121, DCS-5222LB1, DCS-5020L, and many more. There are many affected firmware versions starting from 1.00 and above. The configuration file can be accessed remotely through: <Camera-IP>/common/info.cgi, with no authentication. The configuration file include the following fields: model, product, brand, version, build, hw_version, nipca version, device name, location, MAC address, IP address, gateway IP address, wireless status, input/output settings, speaker, and sensor settings. • https://dojo.bullguard.com/dojo-by-bullguard/blog/i-got-my-eyeon-you-security-vulnerabilities-in-baby-monitor • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 5.3EPSS: 3%CPEs: 38EXPL: 2CVE-2013-1603 – D-Link IP Cameras - Multiple Vulnerabilities
https://notcve.org/view.php?id=CVE-2013-1603
An Authentication vulnerability exists in D-LINK WCS-1100 1.02, TESCO DCS-2121 1.05_TESCO, TESCO DCS-2102 1.05_TESCO, DCS-7510 1.00, DCS-7410 1.00, DCS-6410 1.00, DCS-5635 1.01, DCS-5605 1.01, DCS-5230L 1.02, DCS-5230 1.02, DCS-3430 1.02, DCS-3411 1.02, DCS-3410 1.02, DCS-2121 1.06_FR, DCS-2121 1.06, DCS-2121 1.05_RU, DCS-2102 1.06_FR, DCS-2102 1.06, DCS-2102 1.05_RU, DCS-1130L 1.04, DCS-1130 1.04_US, DCS-1130 1.03, DCS-1100L 1.04, DCS-1100 1.04_US, and DCS-1100 1.03 due to hard-coded credentials that serve as a backdoor, which allows remote attackers to access the RTSP video stream. Se presenta una vulnerabilidad de Autenticación en D-LINK WCS-1100 versión 1.02, TESCO DCS-2121 versión 1.05_TESCO, TESCO DCS-2102 versión 1.05_TESCO, DCS-7510 versión 1.00, DCS-7410 versión 1.00, DCS-6410 versión 1.00, DCS-5635 versión 1.01, DCS-5605 versión 1.01, DCS-5230L versión 1.02, DCS-5230 versión 1.02, DCS-3430 versión 1.02, DCS-3411 versión 1.02, DCS-3410 versión 1.02, DCS-2121 versión 1.06_FR, DCS-2121 versión 1.06, DCS-2121 versión 1.05_RU, DCS-2102 versión 1.06_FR, DCS-2102 versión 1.06, DCS-2102 versión 1.05_RU, DCS-1130L versión 1.04, DCS-1130 versión 1.04_US, DCS-1130 versión 1.03, DCS-1100L versión 1.04, DCS-1100 versión 1.04_US y DCS-1100 versión 1.03, debido a credenciales embebidas que sirven como un backdoor, lo que permite a atacantes remotos acceder a la transmisión de video RTSP. • https://www.exploit-db.com/exploits/25138 http://www.securityfocus.com/bid/59571 https://exchange.xforce.ibmcloud.com/vulnerabilities/83940 https://packetstormsecurity.com/files/cve/CVE-2013-1603 https://vuldb.com/?id.8575 https://www.coresecurity.com/advisories/d-link-ip-cameras-multiple-vulnerabilities • CWE-798: Use of Hard-coded Credentials •
CVSS: 10.0EPSS: 90%CPEs: 36EXPL: 4CVE-2013-1599 – D-Link IP Cameras - Multiple Vulnerabilities
https://notcve.org/view.php?id=CVE-2013-1599
A Command Injection vulnerability exists in the /var/www/cgi-bin/rtpd.cgi script in D-Link IP Cameras DCS-3411/3430 firmware 1.02, DCS-5605/5635 1.01, DCS-1100L/1130L 1.04, DCS-1100/1130 1.03, DCS-1100/1130 1.04_US, DCS-2102/2121 1.05_RU, DCS-3410 1.02, DCS-5230 1.02, DCS-5230L 1.02, DCS-6410 1.00, DCS-7410 1.00, DCS-7510 1.00, and WCS-1100 1.02, which could let a remote malicious user execute arbitrary commands through the camera’s web interface. Existe una vulnerabilidad de inyección de comandos en el script /var/www/cgi-bin/rtpd.cgi en las cámaras IP D-Link DCS-3411/3430 firmware 1.02, DCS-5605/5635 1.01, DCS-1100L / 1130L 1.04, DCS- 1100/1130 1.03, DCS-1100/1130 1.04_US, DCS-2102/2121 1.05_RU, DCS-3410 1.02, DCS-5230 1.02, DCS-5230L 1.02, DCS-6410 1.00, DCS-7410 1.00, DCS-7510 1.00 y WCS-1100 1.02, que podría permitir a un usuario malintencionado remoto ejecutar comandos arbitrarios a través de la interfaz web de la cámara. • https://www.exploit-db.com/exploits/25138 http://www.exploit-db.com/exploits/25138 http://www.securityfocus.com/bid/59564 https://exchange.xforce.ibmcloud.com/vulnerabilities/83941 https://packetstormsecurity.com/files/cve/CVE-2013-1599 https://seclists.org/fulldisclosure/2013/Apr/253 https://www.coresecurity.com/advisories/d-link-ip-cameras-multiple-vulnerabilities • CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') •
CVSS: 7.5EPSS: 11%CPEs: 38EXPL: 2CVE-2013-1602 – D-Link IP Cameras - Multiple Vulnerabilities
https://notcve.org/view.php?id=CVE-2013-1602
An Information Disclosure vulnerability exists due to insufficient validation of authentication cookies for the RTSP session in D-Link DCS-5635 1.01, DCS-1100L 1.04, DCS-1130L 1.04, DCS-1100 1.03/1.04_US, DCS-1130 1.03/1.04_US , DCS-2102 1.05_RU/1.06/1.06_FR/1.05_TESCO, DCS-2121 1.05_RU/1.06/1.06_FR/1.05_TESCO, DCS-3410 1.02, DCS-5230 1.02, DCS-5230L 1.02, DCS-6410 1.0, DCS-7410 1.0, DCS-7510 1.0, and WCS-1100 1.02, which could let a malicious user obtain unauthorized access to video streams. Se presenta una vulnerabilidad de Divulgación de Información debido a una comprobación insuficiente de las cookies de autenticación para la sesión RTSP en D-Link DCS-5635 versión 1.01, DCS-1100L versión 1.04, DCS-1130L versión 1.04, DCS-1100 versiones 1.03/1.04_US, DCS-1130 versiones 1.03/1.04_US , DCS-2102 versiones 1.05_RU/1.06/1.06_FR/1.05_TESCO, DCS-2121 versiones 1.05_RU/1.06/1.06_FR/1.05_TESCO, DCS-3410 versión 1.02, DCS-5230 versión 1.02, DCS-5230L versión 1.02, DCS-6410 versión 1.0, DCS-7410 versión 1.0, DCS-7510 versión 1.0 y WCS-1100 versión 1.02, lo que podría permitir a un usuario malicioso obtener acceso no autorizado a transmisiones de video. • https://www.exploit-db.com/exploits/25138 http://www.securityfocus.com/bid/59569 https://exchange.xforce.ibmcloud.com/vulnerabilities/83942 https://packetstormsecurity.com/files/cve/CVE-2013-1602 https://www.coresecurity.com/advisories/d-link-ip-cameras-multiple-vulnerabilities • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 5.3EPSS: 78%CPEs: 6EXPL: 2CVE-2013-1600 – D-Link IP Cameras - Multiple Vulnerabilities
https://notcve.org/view.php?id=CVE-2013-1600
An Authentication Bypass vulnerability exists in upnp/asf-mp4.asf when streaming live video in D-Link TESCO DCS-2121 1.05_TESCO, TESCO DCS-2102 1.05_TESCO, DCS-2121 1.06_FR, 1.06, and 1.05_RU, DCS-2102 1.06_FR. 1.06, and 1.05_RU, which could let a malicious user obtain sensitive information. Se presenta una vulnerabilidad de omisión de autenticación en el archivo upnp/asf-mp4.asf cuando se transmite video en vivo en D-Link TESCO DCS-2121 versión 1.05_TESCO, TESCO DCS-2102 versión 1.05_TESCO, DCS-2121 versiones 1.06_FR, 1.06 y 1.05_RU, DCS-2102 versiones 1.06_FR, 1.06 y 1.05_RU, lo que podría permitir a un usuario malicioso obtener información confidencial. • https://www.exploit-db.com/exploits/25138 http://www.securityfocus.com/bid/59566 https://exchange.xforce.ibmcloud.com/vulnerabilities/83916 https://packetstormsecurity.com/files/cve/CVE-2013-1600 https://vuldb.com/?id.8572 https://www.coresecurity.com/advisories/d-link-ip-cameras-multiple-vulnerabilities • CWE-287: Improper Authentication •