Akuvox Smart Intercom/Doorphone Unauthenticated Stream Disclosure ≈ Packet Storm

Home ^[1] Files ^[2] News ^[3] &[SERVICES_TAB] Contact ^[4] Add New ^[5]

Akuvox Smart Intercom/Doorphone Unauthenticated Stream Disclosure^[6]: Authored by LiquidWorm ^[7] | Site zeroscience.mk ^[8]; Akuvox Smart Intercom/Doorphone suffers from an unauthenticated live stream disclosure when requesting video.cgi endpoint on port 8080. Many versions are affected.; SHA-256 | b9109fbd6b81561f43a64e422162fa5e99ed650e66b857057e94fc3b868986d0; Download ^[9] | Favorite ^[10] | View ^[11]

        
Akuvox Smart Intercom/Doorphone Unauthenticated Stream Disclosure
Vendor: The Akuvox Company
Product web page: https://www.akuvox.com
Affected version: Doorphone:
S539
S532
X916
X915
X912
R29
Intercom:
R20K-2
R20A-2
C313W-2
NS-2
NC-2
NX-2
Firmware: 912.30.1.137
Summary: Vandal-resistant Door Phone for High-end Buildings. Offering
top-of-the-line features, Akuvox X912 is targeted at high-end residential
and commercial projects. With a compact size, it is perfect for buildings
with limited installation space.
Desc: The application suffers from an unauthenticated live stream disclosure
when requesting video.cgi endpoint on port 8080.
Tested on: lighttpd/1.4.30
EasyHttpServer
Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
@zeroscience
Advisory ID: ZSL-2024-5826
Advisory URL: https://www.zeroscience.mk/en/vulnerabilities/ZSL-2024-5826.php
25.02.2024
--
$ firefox http://192.168.1.2:8080/video.cgi