COMMAX Smart Home Ruvie CCTV Bridge DVR Credential Disclosure Scanner

The COMMAX Smart Home Ruvie CCTV Bridge DVR is widely used in domestic and commercial environments to offer security monitoring solutions. It is primarily utilized by homeowners and businesses looking to integrate advanced security features into their property setups. The system provides remote monitoring capabilities, allowing users to view live camera feeds through the internet. It is commonly used with IoT devices, aimed at enhancing surveillance through intelligent technology. These systems have become an integral part of modern security protocols, used for their robust features and ease of integration into smart home ecosystems. Typically, the system is managed through a user-friendly interface that allows seamless access to all its functionalities.

The vulnerability detected in this context involves the disclosure of RTSP credentials within the COMMAX CCTV Bridge for the DVR service. This critical vulnerability allows unauthorized attackers to obtain sensitive information in plain-text, which can then be exploited to gain access to video feeds. Such vulnerabilities in the security of home automation systems are concerning as they expose crucial control mechanisms to potential malicious actors. Despite several safeguards intended to protect credential data, flaws in the system's access control facilitate this disclosure. Consequently, the vulnerability represents a significant risk to the security of the network and its connected devices. Ensuring updated security protocols is necessary to mitigate this risk.

Technically, the vulnerability lies in the exposure of RTSP credentials within the HTTP body of the system’s interface. Threat actors can exploit the unsecured access path at "/overview.asp" to access login credentials. By sending a GET request to this endpoint, sensitive information including "rtsp://" identifiers is exposed. Additionally, identifiers like "DVR Lists" and "login_check.js" suggest the presence of crucial access data that is insufficiently encrypted or protected. The exposure of "MAX USER" descriptors further indicates lax control over user session management, potentially allowing unauthorized access. This improper disclosure requires immediate security intervention to safeguard against unauthorized data breaches.

If exploited, this vulnerability can lead to unauthorized control over CCTV feeds, undermining the privacy and security of individuals and organizations relying on these systems. Attackers could potentially access live video streams, manipulate video data, or interfere with the system's operation. This not only breaches privacy but poses significant security threats as attackers might use the video footage for malicious purposes or planning further attacks. It underscores the importance of protecting credential data to ensure that surveillance systems perform their intended security role without compromise.

REFERENCES

• https://www.zeroscience.mk/en/vulnerabilities/ZSL-2021-5665.php