Description (CNA)
An improper certificate validation vulnerability exists in AVTECH IP cameras, DVRs, and NVRs due to the use of wget with --no-check-certificate in scripts like SyncCloudAccount.sh and SyncPermit.sh. This exposes HTTPS communications to man-in-the-middle (MITM) attacks.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| AVTECH / IP cameras | affected 0 |
| AVTECH / DVR devices | affected 0 |
| AVTECH / NVR devices | affected 0 |
CWE
CWE-295
References
- https://www.exploit-db.com/exploits/40500
- https://avtech.com/
- https://web.archive.org/web/20240810225729/https://www.search-lab.hu/advisories/126-AVTech-devices-multiple-vulnerabilities
- https://web.archive.org/web/20161029201749/https://github.com/ebux/AVTECH
- https://vulncheck.com/advisories/avtech-ipcamera-nvr-dvr-mulitple-vulns
ADP enrichment
No English description supplied.
No references supplied.