vulnwire
10.0crit

CVE-2007-6638in critical feed1 exploit

March Networks DVR 3204 stores sensitive information under the web root with insufficient access control, which allows remote attackers to…

Published 18 y ago · modified 4 mo ago · JSON

CVSS
10.0
v2.0 · NVD
CISA KEV
No
not known exploited
EPSS
12.6%
percentile 96%
Public exploits
1
Exploit-DB

March Networks DVR 3204 stores sensitive information under the web root with insufficient access control, which allows remote attackers to obtain usernames, passwords, device names, and IP addresses via a direct request for scripts/logfiles.tar.gz.

Exploit prediction (EPSS)

12.60% probability of exploitation in the next 30 days, higher than 96% of all scored CVEs.

Exploits and detections

  • EDB-4797 March Networks DVR 3204 - Logfile Information Disclosure · remote · 2007-12-27

CVSS scores

Assigned byVersionScoreVector
NVD2.010.0AV:N/AC:L/Au:N/C:C/I:C/A:C

Classification

Weakness
  • CWE-264 Permissions, Privileges, and Access Controls

References

  • exploit-db.com /exploits/4797 · exploit, x_refsource_EXPLOIT-DB, x_transferred
  • sybsecurity.com /pages/advisors/static/dvr3204_exp.txt · x_refsource_MISC, x_transferred
  • securityfocus.com /bid/27054 · vdb-entry, x_refsource_BID, x_transferred
  • sybsecurity.com /advisors/SYBSEC-ADV14-March_Networks_DVR_3204_Logfile_Information_Disclosure · x_refsource_MISC, x_transferred
  • osvdb.org /39726 · vdb-entry, x_refsource_OSVDB, x_transferred
  • milw0rm.com /papers/190 · x_refsource_MISC, x_transferred
  • secunia.com /advisories/28211 · third-party-advisory, x_refsource_SECUNIA, x_transferred
  • sybsecurity.com /resources/static/An_Insecurity_Overview_of_the_March_Networks_DVR-CCTV_3204.pdf · x_refsource_MISC, x_transferred

Sources

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.