CVE-2018-3813 getConfigExportFile.cgi on FLIR Brickstream 2300 devices 2.0 4.1.53.166 has Incorrect Access Control, as demonstrated by reading the AVI_USER_ID and AVI_USER_PASSWORD fields via a direct request.
CriticalCVSS 9.8
EPSS 1.2%
- Published
- Updated
- Exploit status
- No public exploit known
Description
getConfigExportFile.cgi on FLIR Brickstream 2300 devices 2.0 4.1.53.166 has Incorrect Access Control, as demonstrated by reading the AVI_USER_ID and AVI_USER_PASSWORD fields via a direct request.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| flir brickstream 2300 2d firmware | = 2.0_4.1.53.166 | No fix listed |
| flir brickstream 2300 3d firmware | = 2.0_4.1.53.166 | No fix listed |
| flir brickstream 2300 3d+ firmware | = 2.0_4.1.53.166 | No fix listed |
References
- misteralfa-hack.blogspot.cl exploit third-party-advisory