AVTECH IP Camera - Command Injection
The endpoint `/cgi-bin/supervisor/Factory.cgi` is vulnerable to command injection via the `action` parameter, allowing remote code execution.
Avtech-视频监控PoC 已收录
CVSS8.8EPSS 88.8%
共找到 6 条公开漏洞记录
The endpoint `/cgi-bin/supervisor/Factory.cgi` is vulnerable to command injection via the `action` parameter, allowing remote code execution.
AVTECH video surveillance products unauthenticated file download from web root through /cgi-bin/cgibox, Since the .cab string is verified by the strstr method, the file download can be realized by adding ?.cab at the end of the file name.
AVTECH DVR device, Search.cgi can be accessed directly. Search.cgi is responsible for searching and accessing cameras in the local network. Search.cgi provides the cgi_query function.
AVTECH Video Surveillance Products password disclosure through /cgi-bin/user/Config.cgi.
AVTECH AVN801 DVR has a security bypass via the administration login captcha