Vulnerability Note VU#785838
TVT TD-2308SS-B DVR contains a directory traversal vulnerability
TVT TD-2308SS-B DVR and possibly other models contain a directory traversal vulnerability (CWE-22).
CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
TVT TD-2308SS-B DVR and possibly other models running firmware version 3.2.0.P-3520A-00 contain a directory traversal vulnerability. An attacker can use directory traversal to download critical files such as the config.dat file for the device which contains the credentials for the web interface. For example:
A remote unauthenticated attacker can download the configuration file of the device and use the obtained administrator credentials to access the web interface. The attacker may then modify the settings of the device and have access to the connected cameras.
We are currently unaware of a practical solution to this problem. Please consider the following workaround.
Restrict access to the TVT DVR interface
Vendor Information (Learn More)
|Vendor||Status||Date Notified||Date Updated|
|Shenzhen TVT Digital Technology Co Ltd||Affected||10 Sep 2013||20 Sep 2013|
CVSS Metrics (Learn More)
Thanks to Cesar Neira for reporting this vulnerability.
This document was written by Adam Rauf.
- CVE IDs: CVE-2013-6023
- Date Public: 25 Oct 2013
- Date First Published: 25 Oct 2013
- Date Last Updated: 25 Oct 2013
- Document Revision: 17
If you have feedback, comments, or additional information about this vulnerability, please send us email.