Starbucks · Report #398797
DVR default username and password
Validstatus
mediumseverity
21upvotes
15 Oct 2018disclosed
How it was found
Summary: default username and password i found in one of your DVR camera system
Description: hi after scanning on starbucks register ip from this site http://bge.he.net i start to scan the ip subnet : ████ then i found this ip : █████ then i try to browse it then i found login page for DVR cam system as can see in this picture : F337222
then i start to test the default username and password like user -- user then i successfully login to your dvr system and browse you cams as i show in this photo : F337223
Steps To Reproduce:
- scanning in this ip subnet ███████ and found █████████
- browse ███████ and i found web client for DVR system
- login by default username and password username : user --- password : user
Impact
an attacker can control your DVR system and changing setting .. etc