CVE-2020-11681

Name of the Vulnerable Software and Affected Versions Castel NextGen DVR version 1.0.0

Description The issue allows low-privileged users to exploit the fact that credentials for the associated SMTP server are stored and displayed in cleartext. This can be used to create an administrator user and obtain the SMTP credentials.

Recommendations For Castel NextGen DVR version 1.0.0, consider restricting access to the SMTP server configuration to prevent low-privileged users from exploiting the cleartext credentials. As a temporary workaround, limit the creation of new administrator users until a fix is available.