Tiandy Video Surveillance System allows unauthorized file uploads

Summary

A security flaw in the Tiandy Video Surveillance System version 7.17.0 allows hackers to upload files without restriction. This means that malicious files could be uploaded to the system, potentially causing harm. The vendor has not responded to a report of this issue, so it's best to update to a patched version or consider alternative solutions.

What to do

No fix is available yet. Check with your software vendor for updates.

Affected software

Vendor	Product	Affected versions	Fix available
tiandy	video_surveillance_system_firmware	7.17.0	–

Original title

A security vulnerability has been detected in Tiandy Video Surveillance System 视频监控平台 7.17.0. The impacted element is the function uploadFile of the file /src/com/tiandy/easy7/core/rest/CLS_REST_Fi...

Original description

A security vulnerability has been detected in Tiandy Video Surveillance System 视频监控平台 7.17.0. The impacted element is the function uploadFile of the file /src/com/tiandy/easy7/core/rest/CLS_REST_File.java. The manipulation of the argument fileName leads to unrestricted upload. The attack may be initiated remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

nvd CVSS2.0 6.5

nvd CVSS3.1 6.3

nvd CVSS4.0 5.3

Vulnerability type

CWE-284 Improper Access Control

CWE-434 Unrestricted File Upload