Executive Summary

The PLANEX CS-QP50F-ING2 smart cameras have a configuration backup interface accessible over HTTP that does not require any authentication. This means a remote attacker can retrieve the device's compressed configuration backup file without needing to log in. The backup file contains sensitive information such as credentials, which can allow the attacker to gain administrative access to the camera and compromise the confidentiality of the environment being monitored.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can allow a remote, unauthenticated attacker to obtain administrative access to the affected smart camera by retrieving sensitive configuration data including credentials. As a result, the attacker can compromise the confidentiality of the monitored environment, potentially leading to unauthorized surveillance, data breaches, or further attacks on connected systems.

Useful 0 Not Useful 0