CVE-2007-6638

March Networks DVR 3204 stores sensitive information under the web root with insufficient access control, which allows remote attackers to obtain usernames, passwords, device names, and IP addresses via a direct request for scripts/logfiles.tar.gz.

Link	Resource
http://www.milw0rm.com/papers/190
http://www.sybsecurity.com/advisors/SYBSEC-ADV14-March_Networks_DVR_3204_Logfile_Information_Disclosure
http://www.sybsecurity.com/pages/advisors/static/dvr3204_exp.txt
http://www.sybsecurity.com/resources/static/An_Insecurity_Overview_of_the_March_Networks_DVR-CCTV_3204.pdf
http://www.securityfocus.com/bid/27054	Exploit
http://secunia.com/advisories/28211	Vendor Advisory
http://osvdb.org/39726
https://www.exploit-db.com/exploits/4797

Configuration 1

cpe:2.3:h:march_networks:3204_dvr:*:*:*:*:*:*:*:*

---

Published : 2008-01-04 12:46

Updated : 2017-09-29 01:30

---

NVD link : CVE-2007-6638

Mitre link : CVE-2007-6638

No products.

CWE-264