CVE-2013-1603 Hardcoded credentials in n/a
Hard-coded credentials in D-Link IP cameras allow remote attackers to bypass authentication and access RTSP video streams.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2013-1603?
CVE-2013-1603 is a medium-severity vulnerability in n/a, published on 28 Jan 2020. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
An Authentication vulnerability exists in D-LINK WCS-1100 1.02, TESCO DCS-2121 1.05_TESCO, TESCO DCS-2102 1.05_TESCO, DCS-7510 1.00, DCS-7410 1.00, DCS-6410 1.00, DCS-5635 1.01, DCS-5605 1.01, DCS-5230L 1.02, DCS-5230 1.02, DCS-3430 1.02, DCS-3411 1.02, DCS-3410 1.02, DCS-2121 1.06_FR, DCS-2121 1.06, DCS-2121 1.05_RU, DCS-2102 1.06_FR, DCS-2102 1.06, DCS-2102 1.05_RU, DCS-1130L 1.04, DCS-1130 1.04_US, DCS-1130 1.03, DCS-1100L 1.04, DCS-1100 1.04_US, and DCS-1100 1.03 due to hard-coded credentials that serve as a backdoor, which allows remote attackers to access the RTSP video stream.
Weakness: CWE-798
Which versions are affected by CVE-2013-1603?
It affects 17 products.
Products include Dlink Dcs-1100 Firmware, Dlink Dcs-1100l Firmware, Dlink Dcs-1130 Firmware, Dlink Dcs-1130l Firmware, Dlink Dcs-2102 Firmware, Dlink Dcs-2121 Firmware and 11 more.
How do I fix CVE-2013-1603?
No fix has been published for CVE-2013-1603 yet. Limit exposure of the affected software until one is available.
Is CVE-2013-1603 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2013-1603 exists.
Public exploit code: 1 Exploit-DB entry.
Other vulnerabilities in n/a
Sources
Also known as GHSA-59jf-rvgr-hx6h.