Description
Arteco Web Client DVR/NVR contains a session hijacking vulnerability with insufficient session ID complexity that allows remote attackers to bypass authentication. Attackers can brute force session IDs within a specific numeric range to obtain valid sessions and access live camera streams without authorization.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Arteco-Global | Arteco Web Client DVR/NVR | Unknown | — |
References
- ExploitDB-49348 exploit
- Arteco Official Vendor Homepage product
- Zero Science Lab Disclosure (ZSL-2020-5613) third-party-advisory
- Packet Storm Security Exploit Archive exploit
- IBM X-Force Exchange Vulnerability Entry 1 vdb-entry
- IBM X-Force Exchange Vulnerability Entry 2 vdb-entry
- CXSecurity Vulnerability Listing exploit
- VulnCheck Advisory: Arteco Web Client DVR/NVR Session ID Brute Force Authentication Bypass third-party-advisory