Auth bypass in Commax Co., Ltd. Smart Home Ruvie Cctv Bridge Dvr Service
CVE-2021-47710
COMMAX Smart Home System is a smart IoT home solution that allows an unauthenticated attacker to disclose RTSP credentials in plain-text by exploiting the /overview.asp endpoint. Attackers can access sensitive information, including login credentials and DVR settings, by submitting a GET request to this endpoint.
Vulnerability class: Broken Authentication
Published · last modified .
EPSS exploit prediction
EPSS: 0.004 (26.1th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 26th percentile — 26.1% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.003 · newest: 0.004 · change: +0.000
Affected products
Weakness classification (CWE)
References
- www.exploit-db.com/exploits/50208 (exploit)
- www.commax.com (product)
- www.zeroscience.mk/en/vulnerabilities/ZSL-2021-5665.php (third-party-advisory)
- www.vulncheck.com/advisories/commax-smart-home-ruvie-cctv-bridge-dvr-service-rt… (third-party-advisory)