CVE-2020-25748 PoC — 多款 Rubetek 产品安全漏洞

Source

https://github.com/jet-pentest/CVE-2020-25748

Associated Vulnerability

Title:多款 Rubetek 产品安全漏洞 (CVE-2020-25748)
Description:Rubetek cameras RV-3406等都是俄罗斯Rubetek的产品。Rubetek cameras RV-3406是一款照相机。Rubetek cameras RV-3409是一款摄相机。Rubetek cameras RV-3411是一款摄像机。 Rubetek 存在安全漏洞，该漏洞源于存在明文传输，攻击者可利用该漏洞修改来自NTP和RTSP服务器的响应，并强制摄像机使用更改后的值，以下版本及产品受到影响： RV-3406, RV-3409, and RV-3411 cameras (fir

Description

CVE-2020-25748

Readme

## CVE-2020-25748

[Suggested description]
A Cleartext Transmission issue was discovered
on Rubetek RV-3406, RV-3409, and
RV-3411 cameras (firmware versions v342, v339).
Someone in the middle can intercept and modify the video data from the
camera, which is transmitted in an unencrypted form. One can also modify
responses from NTP and RTSP servers and force the camera to use the
changed values.
------------------------------------------
[Additional Information]
A letter was sent to the vendor about the vulnerability.
------------------------------------------
[VulnerabilityType Other]
CWE-319: Cleartext Transmission of Sensitive Information
------------------------------------------
[Vendor of Product]
Rubetek (https://rubetek.com/)
------------------------------------------
[Affected Product Code Base]
Camera RV-3406 - Firmware version 339 and 342 are affected. There are no fixed versions
Camera RV-3409 - Firmware version 339 and 342 are affected. There are no fixed versions
Camera RV-3411 - Firmware version 339 and 342 are affected. There are no fixed versions
------------------------------------------
[Affected Component]
RTP service, NTP client, DNS client
------------------------------------------
[Attack Type]
Remote
------------------------------------------
[Impact Denial of Service]
true
------------------------------------------
[Impact Information Disclosure]
true
------------------------------------------
[Attack Vectors]
Someone in the middle can intercept and modify the video data from the camera. You can also modify responses from NTP and RTSP servers and force the camera to use the changed values.
------------------------------------------
[Discoverer]
Sergey Zelensky (Jet Infosystems, jet.su)
------------------------------------------
[Reference]
https://jet.su

File Snapshot


 [4.0K]  /data/pocs/a6afdbdaca1b8ad56eaf07afdf5b810cb7c2360d
└── [1.8K]  README.md

0 directories, 1 file

Shenlong Bot has cached this for you

Remarks

1. It is advised to access via the original source first.

2. If the original source is unavailable, please email f.jinxu#gmail.com for a local snapshot (replace # with @).

3. Shenlong has snapshotted the POC code for you. To support long-term maintenance, please consider donating. Thank you for your support.

Goal Reached Thanks to every supporter — we hit 100%!