CVE-2009-0640 Directory traversal vulnerability in the administrative web server in Swann DVR4-SecuraNet allows remote attackers to read arbitrary files via a .. (dot dot) in the URI, as demonstrated by reading the...
MediumCVSS 5.0
EPSS 2.8%
Public exploit
- Published
- Updated
- Exploit status
- Public exploit available
Description
Directory traversal vulnerability in the administrative web server in Swann DVR4-SecuraNet allows remote attackers to read arbitrary files via a .. (dot dot) in the URI, as demonstrated by reading the vy_netman.cfg file that contains passwords.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| swannsecurity dvr4-securanet | All versions | No fix listed |
References
- 51897 vdb-entry
- packetstorm.linuxsecurity.com exploit
- 33861 third-party-advisory vendor-advisory
- 20090210 Remote Authentication Bypass - Swann DVR4 SecuraNet (possibly DVR9 as well) mailing-list
- 33716 exploit vdb-entry