Auth bypass in Ace Security Aptina Ar0130 960p 1.3mp Camera
CVE-2020-37146
ACE Security WiP-90113 HD Camera contains a configuration disclosure vulnerability that allows unauthenticated attackers to retrieve sensitive configuration files. Attackers can access the camera's configuration backup by sending a GET request to the /config_backup.bin endpoint, exposing credentials and system settings.
Vulnerability class: Broken Authentication
Published · last modified .
CVSS v3 metric
CVSS v3 base score 7.5 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N.
EPSS exploit prediction
EPSS: 0.004 (35.7th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 36th percentile — 35.7% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.004 · newest: 0.004 · change: +0.000
Affected products
Weakness classification (CWE)
References
- www.exploit-db.com/exploits/48127 (exploit)
- acesecurity.jp (product)
- acesecurity.jp/support/top/wip_series/wip-90113 (product)
- www.vulncheck.com/advisories/aptina-ar-p-mp-camera-remote-configuration-disclos… (third-party-advisory)
Frequently asked questions
- What is CVE-2020-37146?
- CVE-2020-37146 is a high-severity vulnerability in Ace Security Aptina Ar0130 960p 1.3mp Camera, classified under Missing Authentication for Critical Function. CVSS score: 7.5/10. Published 2026-02-07.
- How severe is CVE-2020-37146?
- High severity. CVSS v3 base score is 7.5 out of 10.