Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
9.8

SV3C IP Camera can be accessed without login

CVE-2018-12667 · published 8 years ago
Summary

All versions of the SV3C H.264 PoE IP camera allow requests to run internal commands without checking a user session. An attacker could read or change the camera's settings remotely. Update the firmware to the latest version or apply the vendor's recommended configuration changes to require proper authentication.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
sv3c h.264_poe_ip_camera_firmware v2.3.4.2103-s50-ntd-b20170508b
v2.3.4.2103-s50-ntd-b20170823b
cpe:2.3:o:sv3c:h.264_poe_ip_camera_firmware:v2.3.4.2103-s50-ntd-b20170508b:*:*:*:*:*:*:*
Original advisory text
The SV3C HD Camera (L-SERIES V2.3.4.2103-S50-NTD-B20170508B and V2.3.4.2103-S50-NTD-B20170823B) is affected by an improper authentication vulnerability that allows requests to be made to back-end C...
The SV3C HD Camera (L-SERIES V2.3.4.2103-S50-NTD-B20170508B and V2.3.4.2103-S50-NTD-B20170823B) is affected by an improper authentication vulnerability that allows requests to be made to back-end CGI scripts without a valid session. This vulnerability could be used to read and modify the configuration. The vulnerability affects all versions.
References
Fix within
Internet-facing 3 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically (estimated)
  • Gives an attacker full control (estimated)
Severity
9.8 Critical
Exploitation
1% chance of attack within 30 days
Type
CWE-287Improper Authentication
Timeline
Published19 Oct 2018
Updated31 Oct 2026
First seen29 Sep 2026
Sources
CVE-2018-12667 · NVD
Track software like this
Free during beta