← Advisories

Ross Video DashBoard 8.5.1 Insecure Permissions

Low
Advisory ID
ZSL-2019-5516
Release Date
23 April 2019
Vendor
Ross Video Ltd. - https://www.rossvideo.com
Affected Version
8.5.1
Tested On
Microsoft Windows 7 Professional SP1 (EN)
Summary

DashBoard is a free and open platform from Ross Video for facility control and monitoring that enables users to quickly build unique, tailored Custom Panels that make complex operations simple.

Description

DashBoard suffers from an elevation of privileges vulnerability which can be used by a simple authenticated user that can change the executable file with a binary of choice. The vulnerability exist due to the improper permissions, with the 'M' flag (Modify) or 'C' flag (Change) for 'Authenticated Users' group.

Proof of Concept
Disclosure Timeline
N/A
Credits
Vulnerability discovered by Gjoko Krstic
References
Changelog
23.04.2019Initial release
24.04.2019Added reference [1], [2] and [3]
01.05.2019Added reference [4]
23.03.2026Added reference [5]