CVE-2020-11682

Vulnerability

Castel NextGen DVR version 1.0.0 is vulnerable to Cross-Site Request Forgery (CSRF) in all state-changing requests. The web interface sets a __RequestVerificationToken parameter, but the application does not validate it; requests succeed even if the token is removed or arbitrary [1]. This affects all endpoints that modify state, such as user creation.

Exploitation

An attacker can craft a malicious web page that, when visited by an authenticated user, automatically sends a forged request to the DVR (e.g., creating a new admin user). No additional user interaction is required beyond visiting the page. The CSRF token is not checked, so the attacker can omit it or provide any value [1].

Impact

An attacker can perform any state-changing action with the privileges of the victim, including creating, modifying, or deleting users and altering device settings. This can lead to full compromise of the DVR’s administrative functions, potentially allowing unauthorized access to video feeds and system configuration.

Mitigation

As of the publication date, no official patch or fixed version has been released. The vendor (Castel) should implement proper server-side validation of the __RequestVerificationToken for all state-changing requests. Until then, administrators should restrict network access to the DVR web interface and ensure users do not browse untrusted sites while authenticated to the device [1].