The file management interface of iCatch DVR firmware before 20200103 contains broken access control which allows the attacker to remotely manipulate arbitrary file.
CVSS 3.1HIGH 8.8·Network·Low privileges·No interaction·EPSS 0.00824·Published 2020-04-15·Fixed in 20200103CWE-732