[ authorization ] [ registration ] [ restore account ]
Contact us
You can contact us by:
0day Today Exploits Market and 0day Exploits Database

Akuvox Smart Intercom/Doorphone ServicesHTTPAPI Improper Access Control Vulnerability

Author
LiquidWorm
Risk
[
Security Risk Medium
]
0day-ID
0day-ID-39821
Category
web applications
Date add
27-11-2024
Platform
hardware
Akuvox Smart Intercom/Doorphone ServicesHTTPAPI Improper Access Control


Vendor: The Akuvox Company
Product web page: https://www.akuvox.com
Affected version: Doorphone:
                    S539
                    S532
                    X916
                    X915
                    X912
                    R29
                  Intercom:
                    E16C
                    R20K-2
                    R20A-2
                    C313W-2
                    NS-2
                    NC-2
                    NX-2
                  Firmware: 912.30.1.137

Summary: Vandal-resistant Door Phone for High-end Buildings. Offering
top-of-the-line features, Akuvox X912 is targeted at high-end residential
and commercial projects. With a compact size, it is perfect for buildings
with limited installation space.

Desc: The Akuvox Smart Intercom/Doorphone suffers from an insecure service
API access control. The vulnerability in ServicesHTTPAPI endpoint allows
users with "User" privileges to modify API access settings and configurations.
This improper access control permits privilege escalation, enabling unauthorized
access to administrative functionalities. Exploitation of this issue could
compromise system integrity and lead to unauthorized system modifications.

Tested on: lighttpd/1.4.30
           EasyHttpServer


Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
                            @zeroscience


Advisory ID: ZSL-2024-5862
Advisory URL: https://www.zeroscience.mk/en/vulnerabilities/ZSL-2024-5862.php


25.02.2024

--


http://192.168.1.2/#/ServicesHTTPAPI
# user:user

#  0day.today [2024-12-23]  #