CVE-2020-11681 | BDVDB-2026-136749 Detail

Description#

Castel NextGen DVR v1.0.0 stores and displays credentials for the associated SMTP server in cleartext. Low privileged users can exploit this to create an administrator user and obtain the SMTP credentials.

Impact#

No impact statement in the source data.

Weaknesses#

No weakness recorded in the source data.

References#

https://www.securitymetrics.com/blog/attackers-known-unknown-authorization-bypass
http://seclists.org/fulldisclosure/2020/Jun/8
http://packetstormsecurity.com/files/157954/Castel-NextGen-DVR-1.0.0-Bypass-CSRF-Disclosure.html

Exploit#

No public exploit known

History#

Version 12020-06-04Record published in the CVE List.
Version 22024-08-04Most recent update recorded in the CVE List.