Vulnerability Note VU#251133

S2 NetBox is a line of "...open architecture, scalable, IP network-ready products for the physical security industry that integrate access control, alarm monitoring, video surveillance, and temperature monitoring." S2 Netbox systems are operated entirely via a web interface.

The Netbox web server does not properly authenticate access to several directories, allowing an unauthenticated attacker to access network node logs, employee photographs, and backup archives.

Linear (formerly IEI) eMerge is based on S2 Netbox, and Sonitrol eAccess is based on Linear eMerge. eMerge and eAccess may also be affected by this vulnerability.

An unauthenticated, remote attacker can access node logs, backups, and employee photographs. An attacker may be able to crack passwords contained in a backup and gain administrative control over the system. Node logs and employee photographs could provide an attacker with reconnaissance information.

Upgrade or patch
S2 Security has made patches or upgrades available to address this vulnerability for Netbox versions 2.5, 3.3, and 4.0. Please contact S2 or Linear customer support.

Restrict access

Restrict network access to S2 Netbox systems to trusted and authorized hosts and networks. Separate management networks from general purpose user networks. Do not allow access from untrusted networks such as the internet.