Description
VideoFlow Digital Video Protection DVP 2.10 contains an authenticated remote code execution vulnerability that allows authenticated attackers to execute arbitrary system commands by exploiting a cross-site request forgery flaw in the web management interface. Attackers with valid credentials can leverage the CSRF vulnerability to inject and execute system commands through the Tools > System > Shell interface, gaining root-level access to the device.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| VideoFlow | VideoFlow Digital Video Protection | 2.10, 1.40.0.15, 2.10.0.5 | — |
References
- ExploitDB-44387 exploit
- Vulnerability Advisory vendor-advisory
- VulnCheck Advisory: VideoFlow Digital Video Protection DVP 10 Authenticated Remote Code Execution third-party-advisory