Critical · published May 28, 2024
🚨 An unauthenticated HTTP GET request is all it takes for someone to download any file from vulnerable Anpviz IP cameras! 🔥 Think of it like a hotel where anyone can walk in and grab any guest's luggage without anyone checking their ID. The files on these cameras are just sitting there, waiting to be taken without a key! An attacker could access and download sensitive files directly from the device's filesystem, potentially compromising personal data or even gaining insights into private spaces. With a CVSS score of 9.8, this vulnerability is absolutely devastating and must be addressed immediately to prevent unauthorized access!
Think of it like a hotel where anyone can walk in and grab any guest's luggage without anyone checking their ID. The files on these cameras are just sitting there, waiting to be taken without a key! This vulnerability allows unauthenticated users to exploit the /playback/ URI on specific Anpviz products, enabling arbitrary file downloads from the device's filesystem. It affects multiple models running firmware version 3.2.2.2 and lower.
An attacker could access and download sensitive files directly from the device's filesystem, potentially compromising personal data or even gaining insights into private spaces. With a CVSS score of 9.8, this vulnerability is absolutely devastating and must be addressed immediately to prevent unauthorized access! Update all affected Anpviz devices to the latest firmware version as soon as possible. Implement network segmentation to limit access to the devices, and consider applying firewall rules to restrict incoming traffic to trusted sources only. You've got this! Stay vigilant and secure those cameras! 🛡️