p2_4g_video_encoder_firmware vulnerabilities
6 known vulnerabilities in p2_4g_video_encoder_firmware from KiloView. 6 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.
Latest first
- 8.8 High severity
P1/P2: Insufficiently Protected Credentials
The webserver utilizes basic authentication for its user login to the configuration interface. As encryption is disabled on port 80, it enables potential eavesdropping on user traffic, making it possible to intercept their credentials.
- 7.2 High severity
P1/P2: Weak Password Requirements
The user management section of the web application permits the creation of user accounts with excessively weak passwords, including single-character passwords.
- 9.8 Critical severity
P1/P2: Download of Code Without Integrity Check
A vulnerability allows attackers to download source code or an executable from a remote location and execute the code without sufficiently verifying the origin and integrity of the code. This vulnerability can allow attackers to modify the firmware before uplo
- 9.8 Critical severity
P1/P2: Authentication Bypass by Primary Weakness
The vulnerability allows attackers access to the root account without having to authenticate. Specifically, if the device is configured with the IP address of 10.10.10.10, the root user is automatically logged in.
- 10.0 Critical severity
P1/P2: Missing Authentication for Critical Functionality
A vulnerability allows unauthorized access to functionality inadequately constrained by ACLs. Attackers may exploit this to unauthenticated execute commands potentially leading to unauthorized data manipulation, access to privileged functions, or even the exec
- 10.0 Critical severity
Inadequate input validation exposes the system to potential remote code execution (RCE) risks.
Inadequate input validation exposes the system to potential remote code execution (RCE) risks. Attackers can exploit this vulnerability by appending shell commands to the Speed-Measurement feature, enabling unauthorized code execution.