CVE-2018-9031 The login interface on TNLSoftSolutions Sentry Vision 3.x devices provides password disclosure by reading an "if(pwd ==" line in the HTML source code. This means, in effect, that authentication occurs...
CriticalCVSS 9.8
EPSS 1.5%
- Published
- Updated
- Exploit status
- No public exploit known
Description
The login interface on TNLSoftSolutions Sentry Vision 3.x devices provides password disclosure by reading an "if(pwd ==" line in the HTML source code. This means, in effect, that authentication occurs only on the client side.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| tnlsoftsolutions sentry vision | = 3.0 | No fix listed |
| tnlsoftsolutions sentry vision | = 3.1 | No fix listed |
| tnlsoftsolutions sentry vision | = 3.2 | No fix listed |
References
- gist.github.com exploit third-party-advisory
- www.youtube.com third-party-advisory