nvd-json-data-feeds/CVE-2017/CVE-2017-84xx/CVE-2017-8405.json

{
  "id": "CVE-2017-8405",
  "sourceIdentifier": "cve@mitre.org",
  "published": "2019-07-02T20:15:10.870",
  "lastModified": "2021-04-23T18:50:57.627",
  "vulnStatus": "Analyzed",
  "descriptions": [
    {
      "lang": "en",
      "value": "An issue was discovered on D-Link DCS-1130 and DCS-1100 devices. The binary rtspd in /sbin folder of the device handles all the rtsp connections received by the device. It seems that the binary loads at address 0x00012CF4 a flag called \"Authenticate\" that indicates whether a user should be authenticated or not before allowing access to the video feed. By default, the value for this flag is zero and can be set/unset using the HTTP interface and network settings tab as shown below. The device requires that a user logging to the HTTP management interface of the device to provide a valid username and password. However, the device does not enforce the same restriction by default on RTSP URL due to the checkbox unchecked by default, thereby allowing any attacker in possession of external IP address of the camera to view the live video feed. The severity of this attack is enlarged by the fact that there more than 100,000 D-Link devices out there."
    },
    {
      "lang": "es",
      "value": "Se detect\u00f3 un problema en los dispositivos DCS-1130 y DCS-1100 de D-Link. El rtspd binario en la carpeta /sbin del dispositivo maneja todas las conexiones rtsp recibidas por el dispositivo. Al parecer el binario carga en la direcci\u00f3n 0x00012CF4 un flag llamado \"Autenticar\" que indica si un usuario debe estar autenticado o no anterior a permitir el acceso a la fuente de video. Por defecto, el valor de este flag es cero y se puede configurar y desconfigurar mediante la interfaz HTTP y la pesta\u00f1a de configuraci\u00f3n de red, como se muestra a continuaci\u00f3n. El dispositivo requiere que un usuario inicie sesi\u00f3n en la interfaz de administraci\u00f3n HTTP del dispositivo para suministrar un nombre de usuario y una contrase\u00f1a v\u00e1lida. Sin embargo, el dispositivo no impone la misma restricci\u00f3n por defecto en la URL RTSP debido a que la casilla de comprobaci\u00f3n no est\u00e1 activada por defecto, lo que permite que cualquier atacante que posea la direcci\u00f3n IP externa de la c\u00e1mara visualice la fuente de v\u00eddeo en tiempo real. La severidad de este ataque se incrementa por el hecho de que hay m\u00e1s de 100.000 dispositivos D-Link instalados."
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "nvd@nist.gov",
        "type": "Primary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "NONE",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "NONE",
          "availabilityImpact": "NONE",
          "baseScore": 7.5,
          "baseSeverity": "HIGH"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 3.6
      }
    ],
    "cvssMetricV2": [
      {
        "source": "nvd@nist.gov",
        "type": "Primary",
        "cvssData": {
          "version": "2.0",
          "vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
          "accessVector": "NETWORK",
          "accessComplexity": "LOW",
          "authentication": "NONE",
          "confidentialityImpact": "PARTIAL",
          "integrityImpact": "NONE",
          "availabilityImpact": "NONE",
          "baseScore": 5.0
        },
        "baseSeverity": "MEDIUM",
        "exploitabilityScore": 10.0,
        "impactScore": 2.9,
        "acInsufInfo": false,
        "obtainAllPrivilege": false,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ]
  },
  "weaknesses": [
    {
      "source": "nvd@nist.gov",
      "type": "Primary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-287"
        }
      ]
    }
  ],
  "configurations": [
    {
      "operator": "AND",
      "nodes": [
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:o:dlink:dcs-1100_firmware:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "554817F7-7E3D-4D69-90AC-46D86056143B"
            }
          ]
        },
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": false,
              "criteria": "cpe:2.3:h:dlink:dcs-1100:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "704F9608-72CE-49C0-B7D2-F2FE84DF0C74"
            }
          ]
        }
      ]
    },
    {
      "operator": "AND",
      "nodes": [
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:o:dlink:dcs-1130_firmware:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "0DB53465-4FE2-43EF-B2C6-839DFEA80D62"
            }
          ]
        },
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": false,
              "criteria": "cpe:2.3:h:dlink:dcs-1130:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "33A388EC-275D-4180-83E2-AD73F7EEB54F"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "url": "http://packetstormsecurity.com/files/153226/Dlink-DCS-1130-Command-Injection-CSRF-Stack-Overflow.html",
      "source": "cve@mitre.org",
      "tags": [
        "Third Party Advisory",
        "VDB Entry"
      ]
    },
    {
      "url": "https://github.com/ethanhunnt/IoT_vulnerabilities/blob/master/Dlink_DCS_1130_security.pdf",
      "source": "cve@mitre.org",
      "tags": [
        "Exploit",
        "Third Party Advisory"
      ]
    },
    {
      "url": "https://seclists.org/bugtraq/2019/Jun/8",
      "source": "cve@mitre.org",
      "tags": [
        "Mailing List",
        "Third Party Advisory"
      ]
    }
  ]
}