CVE-2021-4469
BaseFortify
Publication date: 2025-11-14
Last updated on: 2025-11-14
Assigner: VulnCheck
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| denver | sho-110 | * |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-306 | The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources. |
| CWE-1242 | The device includes chicken bits or undocumented features that can create entry points for unauthorized actors. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
Denver SHO-110 IP cameras have a secondary HTTP service running on TCP port 8001 that provides access to a '/snapshot' endpoint without requiring any authentication. Although the main web interface on port 80 requires authentication, this backdoor service allows any remote attacker to directly request image snapshots. By repeatedly accessing this endpoint, an attacker can collect images and reconstruct the camera's video stream, thereby compromising the confidentiality of the monitored area.
How can this vulnerability impact me? :
This vulnerability allows an attacker to remotely access image snapshots from the camera without any authentication, enabling them to monitor and reconstruct the camera's video stream. This compromises the confidentiality of the environment being monitored, potentially exposing sensitive or private information to unauthorized parties.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
You can detect this vulnerability by scanning your network for devices with TCP port 8001 open and then attempting to access the '/snapshot' endpoint without authentication. For example, use a command like 'nmap -p 8001 --open <target-ip>' to find devices with port 8001 open. Then, use a tool like curl to request the snapshot endpoint: 'curl http://<target-ip>:8001/snapshot'. If you receive an image without authentication, the device is vulnerable.
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include restricting access to TCP port 8001 on your network by using firewall rules to block or limit access to trusted IPs only. Additionally, disable or restrict the secondary HTTP service on port 8001 if possible. If firmware updates are available from the vendor addressing this issue, apply them promptly.