Vulnerability · Published Feb 27, 2025 · Assigned by INCIBE
CVE-2025-1739Multiple vulnerabilities in Trivision Camera NC227WF
High 7.1
In plain English
A high-severity authentication bypass in Camera NC227WF from Trivision. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 23% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code.
Official description
An Authentication Bypass vulnerability has been found in Trivision Camera NC227WF v5.8.0 from TrivisionSecurity. This vulnerability allows an attacker to retrieve administrator's credentials in cleartext by sending a request against the server using curl with random credentials to "/en/player/activex_pal.asp" and successfully authenticating the application.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Trivision | Camera NC227WF | see references |
Weakness: CWE-288 · Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N