CVE-2021-47710
BaseFortify
Publication date: 2025-12-09
Last updated on: 2025-12-09
Assigner: VulnCheck
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| commax | smart_home_system | 4.0 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-306 | The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources. |
Attack-Flow Graph
AI Powered Q&A
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by sending an unauthenticated GET request to the /overview.asp endpoint on the COMMAX Smart Home Ruvie CCTV Bridge DVR Service, typically accessible on port 8086. For example, you can use the following command to check for exposed RTSP credentials: curl http://TARGET:8086/overview.asp If the response contains RTSP URLs with embedded usernames and passwords in plain text, the system is vulnerable. [2, 4]
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include restricting access to the /overview.asp endpoint by implementing proper authentication and access controls, such as firewall rules limiting access to trusted IPs only. Additionally, monitor and audit network traffic for unauthorized access attempts to this endpoint. Since the vulnerability is due to missing authentication, applying any available patches or updates from the vendor is recommended once available. [2, 4]
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The provided resources do not contain information on how this vulnerability affects compliance with common standards and regulations such as GDPR or HIPAA.
Can you explain this vulnerability to me?
This vulnerability in the COMMAX Smart Home System allows an unauthenticated attacker to obtain RTSP credentials in plain-text by exploiting the /overview.asp endpoint. By sending a GET request to this endpoint, attackers can access sensitive information such as login credentials and DVR settings without needing any authentication.
How can this vulnerability impact me? :
The vulnerability can lead to unauthorized disclosure of sensitive information, including RTSP credentials and DVR settings. This can allow attackers to gain unauthorized access to the smart home system, potentially compromising the security and privacy of the home environment.