CVE-2016-20016

 

Published at: - 19-10-2022 07:15

Last modified: - 21-10-2022 06:52

Total changes: - 2

Description

MVPower CCTV DVR models, including TV-7104HE 1.8.4 115215B9 and TV7108HE, contain a web shell that is accessible via a /shell URI. A remote unauthenticated attacker can execute arbitrary operating system commands as root. This vulnerability has also been referred to as the "JAWS webserver RCE" because of the easily identifying HTTP response server field. Other firmware versions, at least from 2014 through 2019, can be affected. This was exploited in the wild in 2017 through 2022.

Common Vulnerability Scoring System (CVSS)

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

 

Verification logic

 

Reference

• https://www.exploit-db.com/exploits/41471
• https://www.pentestpartners.com/security-blog/pwning-cctv-cameras/
• https://blog.netlab.360.com/iot_reaper-a-rappid-spreading-new-iot-botnet-en/

 

Keywords

NVD

 

CVE-2016-20016

 

CVE

 

Common vulnerabilities & exposures

 

CVSS

 

Common vulnerability scoring system

 

Security

 

Vulnerabilities

 

Exposures