NetSight
IP …
medium6.5

CVE-2020-11949

testserver.cgi of the web service on VIVOTEK Network Cameras before XXXXX-VVTK-2.2002.xx.01x (and before XXXXX-VVTK-0XXXX_Beta2) allows an authenticated user t…

Impact

testserver.cgi of the web service on VIVOTEK Network Cameras before XXXXX-VVTK-2.2002.xx.01x (and before XXXXX-VVTK-0XXXX_Beta2) allows an authenticated user to obtain arbitrary files from a camera's local filesystem. For example, this affects IT9388-HT devices.

Affected products

VendorProductAffected versions
VivotekCc9381-Hv Firmware
through 0222g
VivotekFd9360-H Firmware
through 0222g
VivotekFd9368-Htv Firmware
through 0222g
VivotekFd9380-H Firmware
through 0222g
VivotekFd9388-Htv Firmware
through 0222g
VivotekIb9360-H Firmware
through 0222g
VivotekIb9368-Ht Firmware
through 0222g
VivotekIb9380-H Firmware
through 0222g
VivotekIb9388-Ht Firmware
through 0222g
VivotekIt9360-H Firmware
through 0222g
VivotekIt9380-H Firmware
through 0222g
VivotekIt9388-Ht Firmware
through 0222g

References