CVEvulnerability

CVE-2020-37157

8.7 HIGH Published 2026-02-07 Modified 2026-06-17 Official page ↗

Status: Deferred
Published: 2026-02-07
Last modified: 2026-06-17
Assigner: [email protected]
CVSS 4.0 ([email protected]): 8.7 HIGH — CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1 ([email protected]): 7.5 HIGH — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Weaknesses: CWE-306

Description

DBPower C300 HD Camera contains a configuration disclosure vulnerability that allows unauthenticated attackers to retrieve sensitive credentials through an unprotected configuration backup endpoint. Attackers can download the configuration file and extract hardcoded username and password by accessing the /tmpfs/config_backup.bin resource.

Weakness · CWE (1)

CWE-306 Missing Authentication for Critical Functionality weakness

References

https://web.archive.org/web/20200620110617/https://donev.eu/blog/dbpower-c300-multiple-vulnerabilities web.archive.org
https://www.exploit-db.com/exploits/48095 www.exploit-db.com
https://www.vulncheck.com/advisories/dbpower-c-hd-camera-remote-configuration-disclosure www.vulncheck.com

CVE-2020-37157

Description

Related

Weakness · CWE (1)

References