HexBrain

Starbucks · Report #398797

DVR default username and password

Validstatus
mediumseverity
21upvotes
15 Oct 2018disclosed

How it was found

Summary: default username and password i found in one of your DVR camera system

Description: hi after scanning on starbucks register ip from this site http://bge.he.net i start to scan the ip subnet : ████ then i found this ip : █████ then i try to browse it then i found login page for DVR cam system as can see in this picture : F337222

then i start to test the default username and password like user -- user then i successfully login to your dvr system and browse you cams as i show in this photo : F337223

Steps To Reproduce:

  1. scanning in this ip subnet ███████ and found █████████
  2. browse ███████ and i found web client for DVR system
  3. login by default username and password username : user --- password : user

Impact

an attacker can control your DVR system and changing setting .. etc

This report was disclosed publicly on HackerOne and belongs to its author and the program. See the original