CVE-2019-7315

Genie Access WIP3BVAF WISH IP 3MP IR Auto Focus Bullet Camera devices through 3.x are vulnerable to directory traversal via the web interface, as demonstrated by reading /etc/shadow. NOTE: this product is discontinued, and its final firmware version has this vulnerability (4.x versions exist only for other Genie Access products).

CVSS v3.0

7.5 HIGHCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

CVSS v2.0

5.0 MEDIUMAV:N/AC:L/Au:N/C:P/I:N/A:N

EPSS

11.20% chance of exploitation in the next 30 days, 96th percentile

Nuclei

high · CWE-22

Published

2019-06-17

Updated

2024-08-04

Proof-of-concept exploits (1)

• https://labs.nettitude.com/blog/cve-2019-7315-genie-access-wip3bvaf-ip-camera-directory-t…

Nuclei templates (1)

• projectdiscovery/nuclei-templates/blob/main/http/cves/2019/CVE-2019-7315.yaml

References

• CVE Record
• NVD entry

Related

• CVE-2019-7314
• CVE-2019-7316
• CVE-2019-7307
• CVE-2019-7323
• CVE-2019-7306
• CVE-2019-7342