CVE-2015-6970

Published: Feb 18, 2020Modified: Nov 21, 2024

9.8

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Exploitability: 3.9 / Impact: 5.9

Source: NVD

Description

The web interface in Bosch Security Systems NBN-498 Dinion2X Day/Night IP Cameras with H.264 Firmware 4.54.0026 allows remote attackers to conduct XML injection attacks via the idstring parameter to rcp.xml.

Affected (1)

Products: Boschsecurity: Nbn 498 Dinion2x Day/night Ip Cameras Firmware

Boschsecurity

1 product

Nbn 498 Dinion2x Day/night Ip Cameras Firmware

Configuration A

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Boschsecurity Nbn 498 Dinion2x Day/night Ip Cameras Firmware	Version 4.54.0026

Running on/with	Platform Versions
Boschsecurity Nbn 498 Dinion2x Day/night Ip Cameras	All versions

Related CWEs

CWE-91

XML Injection (aka Blind XPath Injection)

The product does not properly neutralize special elements that are used in XML, allowing attackers to modify the syntax, content, or commands of the XML before it is processed by an end system.

References (2)

https://www.exploit-db.com/exploits/38369/

Source: cve@mitre.org

ExploitThird Party AdvisoryVDB Entry

https://www.exploit-db.com/exploits/38369/

Source: af854a3a-2127-422b-91ae-364da2661108

ExploitThird Party AdvisoryVDB Entry

Timeline

No history available yet.