Vangelis Stykas

The issue allows for FTP access as root due to the presence of the twipc root password. It is noted that all affected customers were migrated by 2020-08-31.

The issue concerns Swann SWWHD-INTCAM-HD devices, which leave the Pre-Shared Key (PSK) in logs even after a factory reset. All affected customers were migrated by 2020-08-31.

The issue allows for blind SQL injection through an unauthenticated script in the web interface, potentially leading to the compromise of the product by exposing information from the underlying PostgreSQL database. The script is accessible without authentication.

The issue allows for session fixation attacks. The server accepts the session ID as a GET parameter, which can be exploited to bypass two-factor authentication in some installations. This could lead to phishing attacks that can bypass the two-factor authentication present in some installations.

The issue allows certain Navarino Infinity functions, when placed in the URL, to bypass authentication mechanisms. This can lead to an information leak.