Authentication bypass in Keeper K5 HD Network Camera



Risk Low
Patch available NO
Number of vulnerabilities 1
CVE-ID CVE-2019-16398
CWE-ID CWE-20
Exploitation vector Local
Public exploit Public exploit code for vulnerability #1 is available.
Vulnerable software
 Keeper K5
Hardware solutions / Security hardware applicances

Vendor Keeper

Security Bulletin

This security bulletin contains one low risk vulnerability.

1) Input validation error

EUVDB-ID: #VU21235

Risk: Low

CVSSv4.0: 5.2 [CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/U:Clear]

CVE-ID: CVE-2019-16398

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

Description

The vulnerability allows a local attacker to execute arbitrary code on the target device.

The vulnerability exists due to insufficient validation of user-supplied input. An attacker with physical access to the device can insert an SD card containing a file named "zskj_script_run.sh" that executes arbitrary code.

Mitigation

Cybersecurity Help is currently unaware of any official solution to address this vulnerability.

Vulnerable software versions

Keeper K5: 20.1.0.25 - 20.1.0.63

CPE2.3 External links

https://gitlab.com/crypt0crc/cve-2019-16398
https://www.youtube.com/watch?v=S_cTme7m8Ng&feature=youtu.be


Q & A

Can this vulnerability be exploited remotely?

No. The attacker should have physical access to the system in order to successfully exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability. However, proof of concept for this vulnerability is available.



###SIDEBAR###