CVE-2020-36925

Published: Jan 6, 2026Modified: Jun 17, 2026Deferred

8.7

Vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Show more

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:XShow less

Source: disclosure@vulncheck.com (Secondary)

Description

Arteco Web Client DVR/NVR contains a session hijacking vulnerability with insufficient session ID complexity that allows remote attackers to bypass authentication. Attackers can brute force session IDs within a specific numeric range to obtain valid sessions and access live camera streams without authorization.

Related CWEs

Insufficient Entropy

The product uses an algorithm or scheme that produces insufficient entropy, leaving patterns or clusters of values that are more likely to occur than others.

References (8)

https://cxsecurity.com/issue/WLB-2020120170

Source: disclosure@vulncheck.com

https://exchange.xforce.ibmcloud.com/vulnerabilities/193750

Source: disclosure@vulncheck.com

https://exchange.xforce.ibmcloud.com/vulnerabilities/194139

Source: disclosure@vulncheck.com

https://packetstorm.news/files/id/160718

Source: disclosure@vulncheck.com

https://www.arteco-global.com

Source: disclosure@vulncheck.com

https://www.exploit-db.com/exploits/49348

Source: disclosure@vulncheck.com

https://www.vulncheck.com/advisories/arteco-web-client-dvrnvr-session-id-brute-force-authentication-bypass

Source: disclosure@vulncheck.com

https://www.zeroscience.mk/en/vulnerabilities/ZSL-2020-5613.php

Source: disclosure@vulncheck.com

Timeline

No history available yet.