Details of VAR-201805-0326

ID

VAR-201805-0326

CVE

CVE-2018-10676

TITLE

TBK Vision DVR Vulnerabilities related to certificate and password management in devices

Trust: 0.8

sources: JVNDB: JVNDB-2018-004800

DESCRIPTION

CeNova, Night OWL, Novo, Pulnix, QSee, Securus, and TBK Vision DVR devices allow remote attackers to download a file and obtain sensitive credential information via a direct request for the download.rsp URI. TBK Vision DVR The device contains vulnerabilities related to certificate and password management.Information is obtained, information is altered, and service operation is disrupted (DoS) There is a possibility of being put into a state. CeNova DVR etc. are DVR (hard disk video recorder) devices from different manufacturers. There are security vulnerabilities in several DVR devices. Products from the following manufacturers are affected: CeNova DVR; Night OWL DVR; Novo DVR; Pulnix DVR; QSee DVR; Securus DVR; TBK Vision DVR

Trust: 1.8

sources: NVD: CVE-2018-10676 // JVNDB: JVNDB-2018-004800 // VULHUB: VHN-120459 // VULMON: CVE-2018-10676

AFFECTED PRODUCTS

vendor:	tbkvision	model:	tbk-dvr4104	scope:	eq	version:	-	Trust: 1.6
vendor:	tbkvision	model:	tbk-dvr4216	scope:	eq	version:	-	Trust: 1.6
vendor:	tbkvision	model:	tbk-dvr4104	scope:	-	version:	-	Trust: 0.8
vendor:	tbkvision	model:	tbk-dvr4216	scope:	-	version:	-	Trust: 0.8

sources: JVNDB: JVNDB-2018-004800 // CNNVD: CNNVD-201805-109 // NVD: CVE-2018-10676

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov:	CVE-2018-10676
value:	CRITICAL
Trust: 1.0
NVD:	CVE-2018-10676
value:	CRITICAL
Trust: 0.8
CNNVD:	CNNVD-201805-109
value:	CRITICAL
Trust: 0.6
VULHUB:	VHN-120459
value:	MEDIUM
Trust: 0.1
VULMON:	CVE-2018-10676
value:	MEDIUM
Trust: 0.1

nvd@nist.gov:	CVE-2018-10676
severity:	MEDIUM
baseScore:	5.0
vectorString:	AV:N/AC:L/AU:N/C:P/I:N/A:N
accessVector:	NETWORK
accessComplexity:	LOW
authentication:	NONE
confidentialityImpact:	PARTIAL
integrityImpact:	NONE
availabilityImpact:	NONE
exploitabilityScore:	10.0
impactScore:	2.9
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 1.9
VULHUB:	VHN-120459
severity:	MEDIUM
baseScore:	5.0
vectorString:	AV:N/AC:L/AU:N/C:P/I:N/A:N
accessVector:	NETWORK
accessComplexity:	LOW
authentication:	NONE
confidentialityImpact:	PARTIAL
integrityImpact:	NONE
availabilityImpact:	NONE
exploitabilityScore:	10.0
impactScore:	2.9
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 0.1

nvd@nist.gov:	CVE-2018-10676
baseSeverity:	CRITICAL
baseScore:	9.8
vectorString:	CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
attackVector:	NETWORK
attackComplexity:	LOW
privilegesRequired:	NONE
userInteraction:	NONE
scope:	UNCHANGED
confidentialityImpact:	HIGH
integrityImpact:	HIGH
availabilityImpact:	HIGH
exploitabilityScore:	3.9
impactScore:	5.9
version:	3.0
Trust: 1.8

sources: VULHUB: VHN-120459 // VULMON: CVE-2018-10676 // JVNDB: JVNDB-2018-004800 // CNNVD: CNNVD-201805-109 // NVD: CVE-2018-10676

PROBLEMTYPE DATA

problemtype:	NVD-CWE-noinfo	Trust: 1.0
problemtype:	CWE-255	Trust: 0.9

sources: VULHUB: VHN-120459 // JVNDB: JVNDB-2018-004800 // NVD: CVE-2018-10676

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-201805-109

TYPE

trust management problem

Trust: 0.6

sources: CNNVD: CNNVD-201805-109

CONFIGURATIONS

sources: JVNDB: JVNDB-2018-004800

PATCH

title:	TBK-DVR4104	url:	http://tbkvision.com/producto/tbk-dvr4104/	Trust: 0.8
title:	TBK-DVR4216	url:	http://tbkvision.com/producto/tbk-dvr4216/	Trust: 0.8
title:	Multiple DVR Repair measures for device security vulnerabilities	url:	http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=79843	Trust: 0.6
title:	CamSploit v1.0.1	url:	https://github.com/maxpowersi/CamSploit	Trust: 0.1
title:	CamSploit v1.0.1	url:	https://github.com/Satcomx00-x00/Camera-CamSploit	Trust: 0.1
title:	Awesome CVE PoC	url:	https://github.com/lnick2023/nicenice	Trust: 0.1
title:	Awesome CVE PoC	url:	https://github.com/qazbnm456/awesome-cve-poc	Trust: 0.1
title:	Awesome CVE PoC	url:	https://github.com/xbl3/awesome-cve-poc_qazbnm456	Trust: 0.1

sources: VULMON: CVE-2018-10676 // JVNDB: JVNDB-2018-004800 // CNNVD: CNNVD-201805-109

EXTERNAL IDS

db:	NVD	id:	CVE-2018-10676	Trust: 2.6
db:	JVNDB	id:	JVNDB-2018-004800	Trust: 0.8
db:	CNNVD	id:	CNNVD-201805-109	Trust: 0.6
db:	VULHUB	id:	VHN-120459	Trust: 0.1
db:	VULMON	id:	CVE-2018-10676	Trust: 0.1

sources: VULHUB: VHN-120459 // VULMON: CVE-2018-10676 // JVNDB: JVNDB-2018-004800 // CNNVD: CNNVD-201805-109 // NVD: CVE-2018-10676

REFERENCES

url:	http://misteralfa-hack.blogspot.cl/2018/05/0day-dvr-multivendor.html	Trust: 1.8
url:	https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2018-10676	Trust: 0.8
url:	https://nvd.nist.gov/vuln/detail/cve-2018-10676	Trust: 0.8
url:	http://misteralfa-hack.blogspot.com/2018/05/0day-dvr-multivendor.html	Trust: 0.8
url:	https://cwe.mitre.org/data/definitions/.html	Trust: 0.1
url:	https://nvd.nist.gov	Trust: 0.1
url:	https://github.com/maxpowersi/camsploit	Trust: 0.1

sources: VULHUB: VHN-120459 // VULMON: CVE-2018-10676 // JVNDB: JVNDB-2018-004800 // CNNVD: CNNVD-201805-109 // NVD: CVE-2018-10676

SOURCES

db:	VULHUB	id:	VHN-120459
db:	VULMON	id:	CVE-2018-10676
db:	JVNDB	id:	JVNDB-2018-004800
db:	CNNVD	id:	CNNVD-201805-109
db:	NVD	id:	CVE-2018-10676

LAST UPDATE DATE

2024-11-23T22:45:19.690000+00:00

SOURCES UPDATE DATE

db:	VULHUB	id:	VHN-120459	date:	2019-10-03T00:00:00
db:	VULMON	id:	CVE-2018-10676	date:	2019-10-03T00:00:00
db:	JVNDB	id:	JVNDB-2018-004800	date:	2018-06-27T00:00:00
db:	CNNVD	id:	CNNVD-201805-109	date:	2019-10-23T00:00:00
db:	NVD	id:	CVE-2018-10676	date:	2024-11-21T03:41:49.900

SOURCES RELEASE DATE

db:	VULHUB	id:	VHN-120459	date:	2018-05-02T00:00:00
db:	VULMON	id:	CVE-2018-10676	date:	2018-05-02T00:00:00
db:	JVNDB	id:	JVNDB-2018-004800	date:	2018-06-27T00:00:00
db:	CNNVD	id:	CNNVD-201805-109	date:	2018-05-02T00:00:00
db:	NVD	id:	CVE-2018-10676	date:	2018-05-02T18:29:00.657