Vulnerability · Published Apr 2, 2024 · Assigned by VulDB

CVE-2024-3160Intelbras HDCVI 1016 HTTP GET Request cap.js information disclosure

Medium 5.3

In plain English

A medium-severity information exposure in HDCVI 1008 from Intelbras. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.7% (higher than 52% of all known vulnerabilities).

Severity (CVSS 3.1)5.3Medium

Exploit odds (30 days)0.7%top 47.7% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

** DISPUTED ** A vulnerability, which was classified as problematic, was found in Intelbras MHDX 1004, MHDX 1008, MHDX 1016, MHDX 5016, HDCVI 1008 and HDCVI 1016 up to 20240401. This affects an unknown part of the file /cap.js of the component HTTP GET Request Handler. The manipulation leads to information disclosure. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The real existence of this vulnerability is still doubted at the moment. The identifier VDB-258933 was assigned to this vulnerability. NOTE: The vendor explains that they do not classify the information shown as sensitive and therefore there is no vulnerability which is about to harm the user.

Affected products (as reported)

Vendor	Product	Versions
Intelbras	MHDX 1004	20240401
Intelbras	MHDX 1008	20240401
Intelbras	MHDX 1016	20240401
Intelbras	MHDX 5016	20240401
Intelbras	HDCVI 1008	20240401
Intelbras	HDCVI 1016	20240401

Weakness: CWE-200 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

References

VDB-258933 | Intelbras HDCVI 1016 HTTP GET Request cap.js information disclosure vdb-entry
VDB-258933 | CTI Indicators (IOB, IOC, TTP, IOA) signature, permissions-required
Submit #305410 | Intelbras MHDX 1004, MHDX 1008, MHDX 1016, MHDX 5016, HDCVI 1008, HDCVI 1016 N/A Exposure of Sensitive Information to an Unauthorized Actor third-party-advisory
https://github.com/netsecfish/intelbras_cap_js exploit