medium6.5
CVE-2020-11680
Castel NextGen DVR v1.0.0 is vulnerable to authorization bypass on all administrator functionality.
Impact
Castel NextGen DVR v1.0.0 is vulnerable to authorization bypass on all administrator functionality. The application fails to check that a request was submitted by an administrator. Consequently, a normal user can perform actions including, but not limited to, creating/modifying the file store, creating/modifying alerts, creating/modifying users, etc.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Castel | Nextgen Dvr Firmware | Version 1.0.0 |
Weakness classification
References
- NVD record
- CVE.org record
- http://packetstormsecurity.com/files/157954/Castel-NextGen-DVR-1.0.0-Bypass-CSRF-Disclosure.html
- http://seclists.org/fulldisclosure/2020/Jun/8
- https://www.securitymetrics.com/blog/attackers-known-unknown-authorization-bypass
- http://packetstormsecurity.com/files/157954/Castel-NextGen-DVR-1.0.0-Bypass-CSRF-Disclosure.html
- http://seclists.org/fulldisclosure/2020/Jun/8
- https://www.securitymetrics.com/blog/attackers-known-unknown-authorization-bypass