CVE-2019-13336

Vulnerability

The dbell Wi-Fi Smart Video Doorbell DB01-S Gen 1 exposes a GoAhead web server on TCP port 81. The endpoint /openlock.cgi accepts loginuse and loginpass parameters but does not validate them; any arbitrary values are accepted, allowing unauthenticated command execution [1]. This affects all units of the DB01-S Gen 1 model, which reached end of life in 2016.

Exploitation

An attacker with network access to the doorbell (locally on the same network or remotely if the device is exposed to the internet) can send an HTTP GET request to http://:81/openlock.cgi?loginuse=any&loginpass=any. No authentication or user interaction is required [1]. The request triggers the doorbell's relay switch, which is typically connected to an electronic door lock.

Impact

Successful exploitation causes the doorbell to announce "door is unlocked" and activates the relay, unlocking any attached door lock. This grants the attacker physical access to the premises. The vulnerability also allows arbitrary command execution via the web server, though the primary demonstrated impact is door unlocking [1].

Mitigation

No patch is available. The vendor has declared the product end-of-life since 2016 and has not released a fix [1]. Users are advised to disconnect the doorbell from the network or replace it with a supported device. The vulnerability is not listed on the CISA Known Exploited Vulnerabilities (KEV) catalog as of the publication date.