Vulnerabilities

TI-2020-09374 CVE-2020-11682 · GHSA-gxxf-h2fp-mgxp

Castel NextGen DVR v1.0.0 is vulnerable to CSRF in all state-changing request.

LOW 30

Castel NextGen DVR v1.0.0 is vulnerable to CSRF in all state-changing request.

CVSS 3.1MEDIUM 6.5 Network No auth User interaction EPSS 0.00644 Published 2020-06-04 No fix listed CWE-352

TI-2020-09373 CVE-2020-11681 · GHSA-p6qr-x996-pvwx

LOW 38

Castel NextGen DVR v1.0.0 stores and displays credentials for the associated SMTP server in cleartext.

CVSS 3.1HIGH 8.1 Network Low privileges No interaction EPSS 0.01143 Published 2020-06-04 No fix listed CWE-522

TI-2020-09372 CVE-2020-11680 · GHSA-h68g-fqf5-wf74

LOW 31

Castel NextGen DVR v1.0.0 is vulnerable to authorization bypass on all administrator functionality.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.01166 Published 2020-06-04 No fix listed CWE-862

TI-2020-09371 CVE-2020-11679 · GHSA-7j5q-g763-3rgh

MEDIUM 42

Castel NextGen DVR v1.0.0 is vulnerable to privilege escalation through the Adminstrator/Users/Edit/:UserId functionality.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.02018 Published 2020-06-04 No fix listed CWE-862