Camtron CMNC-200 IP Camera - Authentication Bypass

Finding 3: Web Based Administration Interface Bypass

CVE: CVE-2010-4232



The CMNC-200 IP Camera has an administrative web

interface that does not handle authentication properly.

Using a properly formatted request, an attacker can bypass

the authentication mechanism.



The first example requires authentication:

http://www.ipcamera.com/system.html



When a second forward slash is placed after the hostname,

authentication is not required.

http://www.ipcamera.com//system.html



This vulnerability allows an attacker to take full control of

the IP Camera.



Vendor Response:

No response received.



Remediation Steps:

No patch currently exists for this issue. To limit exposure,

network access to these devices should be limited to authorized

personnel through the use of Access Control Lists and proper

network segmentation.