CVE-2020-19641 Privilege escalation in n/a

High 8.8 Published 30 Mar 2021 Updated 4 Aug 2024

Authenticated operators can escalate to admin privileges via a crafted request to the user management form in INSMA IP cameras.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2020-19641?

CVE-2020-19641 is a high-severity vulnerability in n/a, published on 30 Mar 2021. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

An issue was discovered in INSMA Wifi Mini Spy 1080P HD Security IP Camera 1.9.7 B. Authenticated attackers with the "Operator" Privilege can gain admin privileges via a crafted request to '/goform/formUserMng'.

Which versions are affected by CVE-2020-19641?

It affects 1 product.

Products include Insma Wifi Mini Spy 1080p Hd Security Ip Camera Firmware.

How do I fix CVE-2020-19641?

No fix has been published for CVE-2020-19641 yet. Limit exposure of the affected software until one is available.

Is CVE-2020-19641 being exploited?

There is no known exploitation of CVE-2020-19641 in the wild and no public exploit code.

Sources

Also known as GHSA-45rx-vcq8-mhj9.