Vulnerabilities > CVE-2020-11679 - Missing Authorization vulnerability in Castel Nextgen DVR Firmware 1.0.0
Attack vector
NETWORK Attack complexity
LOW Privileges required
LOW Confidentiality impact
HIGH Integrity impact
HIGH Availability impact
HIGH Summary
Castel NextGen DVR v1.0.0 is vulnerable to privilege escalation through the Adminstrator/Users/Edit/:UserId functionality. Adminstrator/Users/Edit/:UserId fails to check that the request was submitted by an Administrator. This allows a normal user to escalate their privileges by adding additional roles to their account.
Vulnerable Configurations
| Part | Description | Count |
|---|---|---|
| OS | 1 | |
| Hardware | 1 |
Common Weakness Enumeration (CWE)
Packetstorm
| data source | https://packetstormsecurity.com/files/download/157954/castelnextgendvr100-bypassdisclosexsrf.txt |
| id | PACKETSTORM:157954 |
| last seen | 2020-06-06 |
| published | 2020-06-05 |
| reporter | Aaron Bishop |
| source | https://packetstormsecurity.com/files/157954/Castel-NextGen-DVR-1.0.0-Bypass-CSRF-Disclosure.html |
| title | Castel NextGen DVR 1.0.0 Bypass / CSRF / Disclosure |