COMMAX Smart Home System RTSP Credentials Disclosure Vulnerability

A vulnerability in the COMMAX Smart Home System's CCTV Bridge DVR service allows an unauthenticated attacker to access RTSP credentials in plain text. This issue arises from the /overview.asp endpoint, which can be exploited by sending a GET request. The vulnerability exposes sensitive information such as login credentials and DVR settings.

Impact

Exploitation of this vulnerability leads to unauthorized disclosure of RTSP credentials, which could be used to access video streams or other sensitive information related to the user's DVR settings.

Reproduction

To reproduce this vulnerability, send a GET request to the /overview.asp endpoint on the affected COMMAX Smart Home System. The response will include RTSP credentials in plain text, which can be used to access video streams from the user's DVR.