CVE-2018-13115
Last modified
CVE-2018-13115 is a vulnerability of currently unknown severity. Lack of an authentication mechanism in KERUI Wifi Endoscope Camera (YPC99) allows an attacker to watch or block the camera stream. The RTSP server on port 7070 accepts the command STOP to stop streaming, and the command SETSSID to disconnect a user.. EPSS estimates a 1.02% chance of exploitation in the next 30 days.
Description
Lack of an authentication mechanism in KERUI Wifi Endoscope Camera (YPC99) allows an attacker to watch or block the camera stream. The RTSP server on port 7070 accepts the command STOP to stop streaming, and the command SETSSID to disconnect a user.
Metrics
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Keruigroup | Ypc99 Firmware | All versions |
References
- https://utkusen.com/blog/multiple-vulnerabilities-on-kerui-endoscope-camera.htmlExploit, Third Party Advisory
- https://utkusen.com/blog/multiple-vulnerabilities-on-kerui-endoscope-camera.htmlExploit, Third Party Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2018-13115?
How severe is CVE-2018-13115?
How do I fix CVE-2018-13115?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2018
- CVE-2018-1311The Apache Xerces-C 3.0.0 to 3.2.3 XML parser contains a use…8.1
- CVE-2018-13110All ADB broadband gateways / routers based on the Epicentro …
- CVE-2018-13111There exists a partial Denial of Service vulnerability in Wa…
- CVE-2018-13112get_l2len in common/get.c in Tcpreplay 4.3.0 beta1 allows re…
- CVE-2018-13113The transfer and transferFrom functions of a smart contract …7.5
- CVE-2018-13114Missing authentication and improper input validation in KERU…
- CVE-2018-13116/user/del.php in zzcms 8.3 allows SQL injection via the tabl…
- CVE-2018-1312In Apache httpd 2.2.0 to 2.4.29, when generating an HTTP Dig…9.8
- CVE-2018-13121RealOne Player 2.0 Build 6.0.11.872 allows remote attackers …
- CVE-2018-13122onefilecms.php in OneFileCMS through 2017-10-08 might allow …6.5
- CVE-2018-13123onefilecms.php in OneFileCMS through 2017-10-08 might allow …
- CVE-2018-13126MoxyOnePresale is a smart contract running on Ethereum. The …
Are you affected by CVE-2018-13115?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST