Vulnerability · Published Feb 6, 2026 · Assigned by VulnCheck
CVE-2020-37157DBPower C300 HD Camera - Remote Configuration Disclosure
High 7.5
In plain English
A high-severity missing authentication in DBPower C300 HD Camera from DBPower. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 39% of all known vulnerabilities).
Severity (CVSS 3.1)7.5High
Exploit odds (30 days)0.4%top 61.2% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known
Official description
DBPower C300 HD Camera contains a configuration disclosure vulnerability that allows unauthenticated attackers to retrieve sensitive credentials through an unprotected configuration backup endpoint. Attackers can download the configuration file and extract hardcoded username and password by accessing the /tmpfs/config_backup.bin resource.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| DBPower | DBPower C300 HD Camera | - |
Weakness: CWE-306 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
References
- ExploitDB-48095 exploit
- Archived Researcher Blog technical-description, exploit
- VulnCheck Advisory: DBPower C300 HD Camera - Remote Configuration Disclosure third-party-advisory