CVE-2018-16946

LG LNB*, LND*, LNU*, and LNV* smart network camera devices have broken access control. Attackers are able to download /updownload/t.report (aka Log & Report) files and download backup files (via download.php) without authenticating. These backup files contain user credentials and configuration information for the camera device. An attacker is able to discover the backup filename via reading the system logs or report data, or just by brute-forcing the backup filename pattern. It may be possible to authenticate to the admin account with the admin password.

• CWE-552

• https://github.com/EgeBalci/LG-Smart-IP-Device-Backup-DownloadExploit, Third Party Advisory
• https://www.exploit-db.com/exploits/45394/Exploit, Third Party Advisory, VDB Entry
• https://github.com/EgeBalci/LG-Smart-IP-Device-Backup-DownloadExploit, Third Party Advisory
• https://www.exploit-db.com/exploits/45394/Exploit, Third Party Advisory, VDB Entry

Published

Sep 12, 2018

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2018-16932Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2018-16933Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2018-16934Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2018-16935Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2018-16936Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2018-1694IBM Jazz applications (IBM Rational Collaborative Lifecycle …5.9
• CVE-2018-16947An issue was discovered in OpenAFS before 1.6.23 and 1.8.x b…
• CVE-2018-16948An issue was discovered in OpenAFS before 1.6.23 and 1.8.x b…
• CVE-2018-16949An issue was discovered in OpenAFS before 1.6.23 and 1.8.x b…
• CVE-2018-1695IBM WebSphere Application Server 7.0, 8.0, and 8.5.5 install…7.3
• CVE-2018-16950Inteno DG400 WU7U_ELION3.11.6-170614_1328 devices allow remo…
• CVE-2018-16951xunfeng 0.2.0 allows command execution via CSRF because mass…