CVE-2013-3539 Cross-site request forgery (CSRF) vulnerability in the command/user.cgi in Sony SNC CH140, SNC CH180, SNC CH240, SNC CH280, SNC DH140, SNC DH140T, SNC DH180, SNC DH240, SNC DH240T, SNC DH280, and poss...
MediumCVSS 6.8
EPSS 8.8%
Public exploit
- Published
- Updated
- Exploit status
- Public exploit available
Description
Cross-site request forgery (CSRF) vulnerability in the command/user.cgi in Sony SNC CH140, SNC CH180, SNC CH240, SNC CH280, SNC DH140, SNC DH140T, SNC DH180, SNC DH240, SNC DH240T, SNC DH280, and possibly other camera models allows remote attackers to hijack the authentication of administrators for requests that add users.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| ovislink airlive wl2600cam | All versions | No fix listed |
| sony snc ch140 | All versions | No fix listed |
| sony snc ch180 | All versions | No fix listed |
| sony snc ch240 | All versions | No fix listed |
| sony snc ch280 | All versions | No fix listed |
| sony snc dh140 | All versions | No fix listed |
| sony snc dh140t | All versions | No fix listed |
| sony snc dh180 | All versions | No fix listed |
| sony snc dh240 | All versions | No fix listed |
| sony snc dh240t | All versions | No fix listed |
| sony snc dh280 | All versions | No fix listed |
References
- 20130612 Security Analysis of IP video surveillance cameras exploit mailing-list