published December 15, 2017
⚠️ Sensitive info at risk! ACTi cameras from the D, B, I, and E series using firmware A1D-500-V6.11.31-AC leak user account credentials simply through GET requests — like sending a postcard with your password written on it! 📬 Imagine dropping a postcard in the mail that not only shows your address but also has all your sensitive information out in the open! That’s what these cameras are doing each time they process requests with sensitive data via GET requests. An attacker could potentially harvest user account names and passwords just by inspecting browser history logs or referrer information — a chilling scenario that could lead to unauthorized access to your camera settings, or worse, your entire network!
Imagine dropping a postcard in the mail that not only shows your address but also has all your sensitive information out in the open! That’s what these cameras are doing each time they process requests with sensitive data via GET requests. This vulnerability allows the web application of the affected ACTi camera series to expose sensitive information through GET requests, where account credentials are appended in the URL, making them easily accessible through various logs and histories.
An attacker could potentially harvest user account names and passwords just by inspecting browser history logs or referrer information — a chilling scenario that could lead to unauthorized access to your camera settings, or worse, your entire network! To protect your information, upgrade the firmware of your ACTi cameras to a version that mitigates this vulnerability. Regularly check for updates, and consider using POST methods for sensitive transactions when possible. 🛡️ You've got this! By taking these steps, you'll be well on your way to securing your cameras and keeping your data safe! 🔒