Multiple Vivotek IP Cameras CVE-2013-4985 Remote Authentication Bypass Vulnerability

Bugtraq ID:	63541
Class:	Access Validation Error
CVE:	CVE-2013-4985
Remote:	Yes
Local:	No
Published:	Nov 05 2013 12:00AM
Updated:	Dec 10 2013 12:57AM
Credit:	Martin Di Paola of Core Security QA Team.
Vulnerable:
Not Vulnerable:

Multiple Vivotek IP Cameras CVE-2013-4985 Remote Authentication Bypass Vulnerability

Multiple Vivotek IP Cameras are prone to a remote authentication-bypass vulnerability.

An attacker can exploit this issue to bypass the authentication mechanism and gain unauthorized access to the restricted functionality of the device.

The following products are vulnerable:

Vivotek IP7160 IP Camera running firmware 0105a
Vivotek IP7160 IP Camera running firmware 0105b
Vivotek IP7361 IP Camera running firmware 0105a
Vivotek IP7361 IP Camera running firmware 0105b
Vivotek IP8332 IP Camera running firmware 0105a
Vivotek IP8332 IP Camera running firmware 0105b

Multiple Vivotek IP Cameras CVE-2013-4985 Remote Authentication Bypass Vulnerability

The researcher who discovered this issue has created a proof-of-concept. Please see the references for more information.

The following exploit is available:

• /data/vulnerabilities/exploits/63541.py

Multiple Vivotek IP Cameras CVE-2013-4985 Remote Authentication Bypass Vulnerability

Solution:
Updates are available. Please see the references or vendor advisory for more information.

Multiple Vivotek IP Cameras CVE-2013-4985 Remote Authentication Bypass Vulnerability

References:

• Vivotek Homepage (Vivotek )