title: GeoVision GV-ADR2701 Improper Authentication
description: In GeoVision GV-ADR2701 cameras, an attacker could edit the login response to access the web application.
problem types: CWE-287: Improper Authentication
affected:
{
defaultStatus: unaffected
product: GV-ADR2701
vendor: GeoVision
versions:
status: affected, version: 1.00_2017_12_15
}
metrics:
cvssV3_1: [
attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 9.8
baseSeverity: CRITICAL
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
version: 3.1
]
format: CVSS
scenarios: GENERAL
solutions: GeoVision recommends that users of these devices upgrade to newer models
with the latest firmware update which they have verified are not
vulnerable to this issue such as TDR2704, TDR2702, or TDR2700.
Alternatively, users could restrict connection of these cameras to
closed local area networks isolated from internet connection.