Vivotek IP Camera Firmware Unauthorized Access Vulnerability [CVE-2019-10256]

CVE number – CVE-2019-10256

A vulnerability in Vivotek IP Cameras could allow an unauthenticated, remote attacker to perform unauthorized actions on a targeted device.

The vulnerability is due to an undisclosed condition that exists within the affected software. An attacker could exploit this vulnerability by sending a request that submits malicious input to the targeted device. A successful exploit could allow the attacker to modify or delete content, perform unauthorized functions, or take over administration of the targeted device without permission checks.

Vivotek has confirmed the vulnerability and released software updates.

Analysis

• At the time this alert was first published, details were limited on how an attacker could successfully exploit this vulnerability. A successful exploit of the vulnerability could allow the attacker to perform unauthorized actions on the targeted device, which could allow the attacker to conduct further attacks.

Safeguards

• Administrators are advised to apply the appropriate updates.
  
  Administrators are advised to allow only trusted users to have network access.
  
  Administrators are advised to run both firewall and antivirus applications to minimize the potential of inbound and outbound threats.
  
  Administrators may consider using IP-based access control lists (ACLs) to allow only trusted systems to access the affected systems.
  
  Administrators can help protect affected systems from external attacks by using a solid firewall strategy.
  
  Administrators are advised to monitor affected systems.

Vendor Announcements

• Vivotek has released a security advisory at the following link: VVTK-SA-2019-001

Fixed Software

• Vivotek has released a firmware upgrade to address this vulnerability as indicated in the Solution section of the vendor advisory. Customers are advised to contact the vendor for help with the firmware upgrade at the following link: Vivotek Contact Us