Trivision Camera NC227WF Authentication Bypass Vulnerability Allowing Credential Retrieval

An authentication bypass vulnerability has been identified in the Trivision Camera NC227WF, version 5.8.0. This vulnerability allows attackers to retrieve administrator credentials in cleartext. Exploitation involves sending a request to the server's '/en/player/activex_pal.asp' endpoint with random credentials. If the application successfully authenticates, the administrator's credentials can be extracted.

Impact

Exploitation of this vulnerability allows for unauthorized access to administrator credentials, which could lead to further exploitation of the camera or its network.

Reproduction

To reproduce this vulnerability, send a request to the camera's server using curl. Include random credentials in the request. Target the '/en/player/activex_pal.asp' endpoint. If the application authenticates successfully, the administrator's credentials will be returned in cleartext.