CVE-2021-4468: PLANEX CS-QP50F-ING2 Smart Camera Remote Configuration Disclosure
PLANEX CS-QP50F-ING2 smart cameras expose a configuration backup interface over HTTP that does not require authentication. A remote, unauthenticated attacker can directly retrieve a compressed configuration backup file from the device. The backup contains sensitive configuration information, including credentials, allowing an attacker to obtain administrative access to the camera and compromise the confidentiality of the monitored environment.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2021-4468?
CVE-2021-4468 is considered a critical vulnerability due to the risk of unauthorized access to sensitive configuration information.
How do I fix CVE-2021-4468?
To remediate CVE-2021-4468, ensure that the backup interface is disabled or secured with proper authentication mechanisms.
What type of information can be accessed through CVE-2021-4468?
CVE-2021-4468 exposes sensitive configuration data contained in the backup file, which can be exploited by attackers.
Who is affected by CVE-2021-4468?
CVE-2021-4468 affects users of the PLANEX CS-QP50F-ING2 smart cameras that expose an unauthenticated HTTP backup interface.
Is CVE-2021-4468 actively being exploited?
As of the latest updates, there have been reports suggesting that CVE-2021-4468 could be actively targeted by attackers seeking unauthorized access.