CVE-2020-36874

Name of the Vulnerable Software and Affected Versions ACE SECURITY WIP-90113 HD cameras (affected versions not specified)

Description ACE SECURITY WIP-90113 HD cameras have an issue where configuration information can be disclosed without authentication. The /web/cgi-bin/hi3510/backup.cgi API endpoint allows remote download of a compressed configuration backup without requiring any authentication or authorization. This backup may contain administrative credentials and other sensitive device settings. An unauthenticated remote attacker could obtain this information, potentially leading to further compromise of the camera or the connected network.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.