CVE-2018-10770

download.rsp on ShenZhen Anni "5 in 1 XVR" devices allows remote attackers to download the configuration (without a login) to discover the password.

• CWE-200

• https://github.com/D0neMkj/EXP_IOT/blob/master/CAMERA/XVR_camera/readmeThird Party Advisory
• https://github.com/D0neMkj/EXP_IOT/tree/master/CAMERA/XVR_cameraExploit, Third Party Advisory
• https://github.com/D0neMkj/EXP_IOT/blob/master/CAMERA/XVR_camera/readmeThird Party Advisory
• https://github.com/D0neMkj/EXP_IOT/tree/master/CAMERA/XVR_cameraExploit, Third Party Advisory

Published

May 9, 2018

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2018-10762Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultI…
• CVE-2018-10763Multiple cross-site scripting (XSS) vulnerabilities in Synam…
• CVE-2018-10767There is a stack-based buffer over-read in calling GLib in t…
• CVE-2018-10768There is a NULL pointer dereference in the AnnotPath::getCoo…
• CVE-2018-10769The transferProxy and approveProxy functions of a smart cont…
• CVE-2018-1077Spacewalk 2.6 contains an API which has an XXE flaw allowing…
• CVE-2018-10771Stack-based buffer overflow in the get_key function in parse…9.8
• CVE-2018-10772The tEXtToDataBuf function in pngimage.cpp in Exiv2 through …
• CVE-2018-10773NULL pointer deference in the addsn function in serialno.c i…
• CVE-2018-10774Read access violation in the isiin_keyword function in isiin…
• CVE-2018-10775NULL pointer dereference in the _fields_add function in fiel…
• CVE-2018-10776The getbits function in mpglibDBL/common.c in mp3gain throug…