CVE-2024-35343

CRITICAL Year: 2024
CVSS v3 Score
9.8
Critical
Weakness Type
CWE-200
View all →

Vulnerability Description

Certain Anpviz products allow unauthenticated users to download arbitrary files from the device's filesystem via a HTTP GET request to the /playback/ URI. This affects IPC-D250, IPC-D260, IPC-B850, IPC-D850, IPC-D350, IPC-D3150, IPC-D4250, IPC-D380, IPC-D880, IPC-D280, IPC-D3180, MC800N, YM500L, YM800N_N2, YMF50B, YM800SV2, YM500L8, and YM200E10 (IP Cameras) firmware v3.2.2.2 and lower and possibly more vendors/models of IP camera.

Related Vulnerabilities

CVE-2008-0655

CRITICAL
CVSS:9.8(Critical)

Multiple unspecified vulnerabilities in Adobe Reader and Acrobat before 8.1.2 have unknown impact and attack vectors.

CWE-2002008

CVE-2010-3845

CRITICAL
CVSS:9.8(Critical)

libapache-authenhook-perl 2.00-04 stores usernames and passwords in plaintext in the vhost error log.

CWE-2002010

CVE-2014-6437

CRITICAL
CVSS:9.8(Critical)

Aztech ADSL DSL5018EN (1T1R), DSL705E, and DSL705EU devices allow remote attackers to obtain sensitive device configuration information via vectors involving the ROM file.

CWE-2002014

CVE-2014-8174

CRITICAL
CVSS:9.8(Critical)

eDeploy makes it easier for remote attackers to execute arbitrary code by leveraging use of HTTP to download files.

CWE-2002014

CVE-2015-0152

CRITICAL
CVSS:9.8(Critical)

D-Link DIR-815 devices with firmware before 2.07.B01 allow remote attackers to obtain sensitive information by leveraging cleartext storage of the administrative password.

CWE-2002015

CVE-2015-0310

CRITICAL
CVSS:9.8(Critical)

Adobe Flash Player before 13.0.0.262 and 14.x through 16.x before 16.0.0.287 on Windows and OS X and before 11.2.202.438 on Linux does not properly restrict discovery of memory addresses, which allows...

CWE-2002015