← Advisories

Rifatron Intelligent Digital Security System (animate.cgi) Stream Disclosure

Medium
Advisory ID
ZSL-2019-5532
Release Date
08 September 2019
Vendor
Rifatron Co., Ltd., SAM MYUNG Co., Ltd. - http://www.rifatron.com
Affected Version
5brid DVR (HD6-532/516, DX6-516/508/504, MX6-516/508/504, EH6-504), 7brid DVR (HD3-16V2, DX3-16V2/08V2/04V2, MX3-08V2/04V2), Firmware: <=8.0 (000143)
Tested On
Embedded Linux, Boa/0.94.14rc21
Summary

Rifatron with its roots in Seoul, Korea has been supplying and servicing the security market as a leading CCTV/video surveillance security system manufacturer, specializing in stand-alone digital video recorder since 1998. We are known for marking the first standalone DVR with audio detection and 480 frames per secone(fps) and have been focusing on highend products and large projects in a variety applications and merket. These include government and public services, banking and finance, hotels and entertatinment, retail education, industrial and commercial sectors throughout Europe, Middle East, the U.S. and Asia. Based on the accumulated know-how in the security industry, Rifatron is trying its utmost for the technology development and customer satisfaction to be the best security solution company in the world.

Description

The DVR suffers from an unauthenticated and unauthorized live stream disclosure when animate.cgi script is called through Mobile Web Viewer module.

Proof of Concept
Disclosure Timeline
N/A
Credits
Vulnerability discovered by Gjoko Krstic
References
Changelog
08.09.2019Initial release
17.09.2019Added reference [1], [2], [3] and [4]
23.03.2026Added reference [5]