CVE-2025-67160 — Vatilon-based IP Cameras

Summary

Vatilon-based IP camera firmware exposes multiple internal web directories without requiring authentication. When directory indexing is enabled on the embedded web server, unauthenticated attackers can access directories such as /cgi-bin/, /view/, /css/, /img/, /img2/, /js/, /js2/, and /onvif/, revealing internal scripts, configuration pages, and sensitive implementation details.

This exposure allows attackers to study the internal structure of the web interface and can increase the impact of other vulnerabilities, such as authentication bypass or unauthorized configuration access.

Vulnerability type: Incorrect Access Control
Impact: Remote Information Disclosure
CVSS v3.1: 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)

---

Affected Devices (Observed)

Other models using the same Vatilon firmware may also be affected.

---

Proof-of-Concept Disclosure Notice

Reproduction details and raw evidence are withheld from public disclosure due to potential abuse. Authorized parties (vendors, CERTs, CNAs) may request additional technical details after verification.

---

Additional Observations

• The embedded web server allows unauthenticated directory listing on multiple top-level paths, including /view/, /cgi-bin/, /css/, /img/, /img2/, /js/, /js2/, and /onvif/.
• These directories contain HTML, JavaScript, and CGI components intended to be accessed only after successful authentication.
• Exposed frontend scripts reveal sensitive implementation details, such as internal API endpoints and required request parameters.
• Several client-side scripts embed username and password fields into API request logic.
• Loading pages such as /view/player.html directly through exposed directories can cause the browser to issue API requests that include cleartext credential values in network traffic.
• Because these resources are accessible without a valid login session, attackers can observe and replicate internal API behavior, including unauthorized requests to /cgi-bin/web.cgi.

---

Impact

• Disclosure of internal web application structure and resource layout.
• Exposure of API endpoints and parameter usage that are not intended for unauthenticated users.
• Increased likelihood of secondary exploitation, including authentication bypass and unauthorized configuration access when combined with other flaws.
• The issue is fully reproducible through a standard web browser without user interaction.

---

Mitigation / Recommendations

1. Disable directory indexing on the embedded web server.
2. Enforce authentication checks before serving internal directories and static resources.
3. Restrict access to CGI handlers and management interfaces.
4. Remove sensitive information and credentials from client-side scripts.
5. Apply firmware updates provided by the vendor when available.
6. Monitor web server logs for abnormal directory access attempts.

---

References

• NVD Entry
• CVE.org Entry

---

요약

Vatilon 기반 IP 카메라 펌웨어에서 인증 없이 내부 웹 디렉터리에 접근할 수 있는 취약점이 확인되었습니다.
공격자는 /cgi-bin/, /view/, /css/, /js/, /img/, /onvif/ 등의 디렉터리를 직접 열람할 수 있으며, 이를 통해 내부 구조, API 엔드포인트, 요청 파라미터 등의 민감한 구현 정보를 확인할 수 있습니다.

이 취약점은 단독으로는 설정 변경이나 코드 실행을 유발하지 않지만, 인증 우회와 같은 다른 취약점과 결합될 경우 공격 효율을 크게 높일 수 있습니다.

취약점 유형: 잘못된 접근 제어
영향: 원격 정보 노출
CVSS v3.1: 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)

---

영향 대상 장비 (확인된 사례)

---

개념 증명(재현 자료) 비공개 안내

재현 절차 및 원본 증거는 악용 위험으로 인해 공개하지 않습니다.
벤더, CERT, CNA 등 공인 기관은 검증 후 추가 기술 정보를 요청할 수 있습니다.

---

추가 관찰사항

• 본 취약점은 내부 리소스 노출로 인한 정보 수집 성격이 강합니다.
• 단독 악용보다는 다른 취약점과의 연계 시 위험도가 증가합니다.

---

영향

• 내부 웹 리소스 및 구조 정보 노출
• 공격 표면 확대
• 2차 공격 가능성 증가

---

완화 권고

1. 디렉터리 인덱싱을 비활성화하십시오.
2. 인증되지 않은 리소스 접근을 차단하십시오.
3. 관리용 웹 리소스를 외부에 노출하지 마십시오.
4. 벤더에서 제공하는 보안 업데이트를 적용하십시오.
5. 비정상적인 디렉터리 접근 시도를 모니터링하십시오.