CVE-2020-11625

Vulnerability

An issue exists in AvertX Auto focus Night Vision HD Indoor/Outdoor IP Dome Camera HD838 and Night Vision HD Indoor/Outdoor Mini IP Bullet Camera HD438. The web login endpoint ISAPI/Security/sessionLogin/capabilities returns different responses depending on whether the submitted username is valid. If the username exists, the response includes the salt value for that user, even if the password is incorrect. If the username does not exist, the salt value is empty. This behavior allows an attacker to enumerate valid usernames without authentication [1].

Exploitation

An attacker with network access to the camera can send a crafted login request to the ISAPI/Security/sessionLogin/capabilities endpoint. By observing whether the response contains a non-empty salt value, the attacker can determine if a given username is registered. No authentication or prior knowledge is required; the attacker only needs to supply a username. This enumeration can be automated to build a list of valid usernames [1].

Impact

Successful enumeration of valid usernames facilitates targeted brute-force attacks against the camera's login mechanism. An attacker can focus password guessing attempts on known accounts, increasing the likelihood of gaining unauthorized access. This could lead to full compromise of the camera, including video stream access and device control [1].

Mitigation

No official fix has been disclosed in the available references. Users should restrict network access to the camera's web interface, use strong, unique passwords, and monitor for unauthorized login attempts. If possible, apply any vendor-supplied firmware updates when they become available [1].