CVE-2020-28999 Hardcoded credentials in n/a
Remote attackers can take full control of Geeni smart doorbells by using hardcoded credentials found in the streaming library.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2020-28999?
CVE-2020-28999 is a high-severity vulnerability in n/a, published on 26 Jan 2021. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
An issue was discovered in Apexis Streaming Video Web Application on Geeni GNC-CW013 doorbell 1.8.1 devices. A remote attacker can take full control of the camera with a high-privileged account. The vulnerability exists because a static username and password are compiled into a shared library (libhipcam.so) used to provide the streaming camera service.
Weakness: CWE-798
Which versions are affected by CVE-2020-28999?
It affects 1 product.
Products include Mygeeni Gnc-Cw013 Firmware.
How do I fix CVE-2020-28999?
No fix has been published for CVE-2020-28999 yet. Limit exposure of the affected software until one is available.
Is CVE-2020-28999 being exploited?
There is no known exploitation of CVE-2020-28999 in the wild and no public exploit code.
Other vulnerabilities in n/a
Sources
Also known as GHSA-36g6-qxc2-h92h.