Todor Donev

The software contains a directory traversal flaw that allows unauthenticated attackers to access sensitive configuration files. This is achieved by exploiting directory listing within the `cgi-bin` directory. Attackers can request the ''getadslattr.cgi'' endpoint to retrieve ADSL credentials and network configuration parameters, including usernames, passwords, and DNS settings.

The IntelBras Telefone IP TIP200 and 200 LITE devices have an issue allowing unauthorized reading of arbitrary files. This is due to a flaw in the `dumpConfigFile()` function, which is accessible through the `cgiServer.exx` endpoint. An attacker can exploit this by sending GET requests to the `/cgi-bin/cgiServer.exx` API endpoint with the `command` parameter set to `dumpConfigFile()`. This allows the attacker to read sensitive files, such as `/etc/shadow` and configuration files, without authentication.

An unauthenticated attacker can retrieve sensitive configuration files from the camera. Accessing the camera’s configuration backup is possible by sending a GET request to the `/config backup.bin` endpoint, which exposes credentials and system settings.

The DBPower C300 HD Camera has a configuration disclosure issue. Unauthenticated attackers can obtain sensitive credentials by accessing an unprotected configuration backup endpoint. Specifically, attackers can download the configuration file and extract hardcoded username and password from the `/tmpfs/config backup.bin` resource.

ACE SECURITY WIP-90113 HD cameras have an issue where configuration information can be disclosed without authentication. The `/web/cgi-bin/hi3510/backup.cgi` API endpoint allows remote download of a compressed configuration backup without requiring any authentication or authorization. This backup may contain administrative credentials and other sensitive device settings. An unauthenticated remote attacker could obtain this information, potentially leading to further compromise of the camera or the connected network.

ESCAM QD-900 WIFI HD cameras have an unauthenticated configuration disclosure issue in the `/web/cgi-bin/hi3510/backup.cgi` endpoint. This endpoint allows remote download of a compressed configuration backup without authentication or authorization. The exposed backup may contain administrative credentials and other sensitive device settings, potentially enabling an unauthenticated remote attacker to gain information that could compromise the camera or connected network.

Dongyoung Media DM-AP240T/W wireless access points have an issue where the `/cgi-bin/sys system config` API endpoint allows remote retrieval of a configuration archive without authentication. This allows an attacker to obtain administrative credentials and other sensitive settings, potentially leading to further compromise.

Tellion HN-2204AP routers have an issue where the `/cgi-bin/system config file` management endpoint allows remote retrieval of a compressed configuration archive without authentication or authorization. The exposed configuration may contain administrative credentials, wireless keys, and other sensitive settings. This could allow an unauthenticated attacker to obtain information that could facilitate further compromise of the device or network.

The Astak CM-818T3 2.4GHz wireless security surveillance cameras contain an unauthenticated configuration disclosure issue. The `/web/cgi-bin/hi3510/backup.cgi` API endpoint allows remote download of a compressed configuration backup without authentication or authorization. The exposed backup may contain administrative credentials and other sensitive device settings, potentially enabling an unauthenticated remote attacker to gain information that could compromise the camera or connected network.

The PLANEX CS-QP50F-ING2 smart cameras have a configuration backup interface accessible over HTTP without authentication. An unauthenticated remote attacker can retrieve a compressed configuration backup file directly from the device. This backup file contains sensitive configuration information, including credentials, potentially granting the attacker administrative access to the camera and compromising the monitored environment.

Name of the Vulnerable Software and Affected Versions: D-Link DSL-2730U version IN 1.02 D-Link DSL-2750U version SEA 1.04 D-Link DSL-2750E version SEA 1.07 Description: A path traversal vulnerability exists in the web management interface of D-Link ADSL routers due to insufficient input validation on the `getpage` parameter within the "/cgi-bin/webproc" CGI script. This flaw allows an unauthenticated remote attacker to perform path traversal attacks by supplying crafted requests, enabling arbitrary file read on the affected device. Recommendations: For D-Link DSL-2730U version IN 1.02, consider disabling the `/cgi-bin/webproc` CGI script until a patch is available. For D-Link DSL-2750U version SEA 1.04, restrict access to the `getpage` parameter to minimize the risk of exploitation. For D-Link DSL-2750E version SEA 1.07, avoid using the `getpage` parameter in the affected API endpoint until the issue is resolved.

The issue allows remote attackers to read arbitrary files via a full pathname in the `file` parameter. This is an absolute path traversal vulnerability in a file in the Enigma2 Webinterface.

A directory traversal issue exists in the file component, allowing remote attackers to read arbitrary files by manipulating the `file` parameter.