CVE-2013-1602
published 2020-01-28CVE-2013-1602: An Information Disclosure vulnerability exists due to insufficient validation of authentication cookies for the RTSP session in D-Link DCS-5635 1.01, DCS-1100L…
PriorityP262high7.5CVSS 3.1
AVNACLPRNUINSUCHINAN
EXPLOIT
EPSS
15.08%
96.3th percentile
An Information Disclosure vulnerability exists due to insufficient validation of authentication cookies for the RTSP session in D-Link DCS-5635 1.01, DCS-1100L 1.04, DCS-1130L 1.04, DCS-1100 1.03/1.04_US, DCS-1130 1.03/1.04_US , DCS-2102 1.05_RU/1.06/1.06_FR/1.05_TESCO, DCS-2121 1.05_RU/1.06/1.06_FR/1.05_TESCO, DCS-3410 1.02, DCS-5230 1.02, DCS-5230L 1.02, DCS-6410 1.0, DCS-7410 1.0, DCS-7510 1.0, and WCS-1100 1.02, which could let a malicious user obtain unauthorized access to video streams.
Affected
21 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| dlink | dcs-1100_firmware | — | — |
| dlink | dcs-1100_firmware | — | — |
| dlink | dcs-1100l_firmware | — | — |
| dlink | dcs-1130_firmware | — | — |
| dlink | dcs-1130_firmware | — | — |
| dlink | dcs-1130l_firmware | — | — |
| dlink | dcs-2102_firmware | — | — |
| dlink | dcs-2102_firmware | — | — |
| dlink | dcs-2121_firmware | — | — |
| dlink | dcs-2121_firmware | — | — |
| dlink | dcs-3410_firmware | — | — |
| dlink | dcs-3411_firmware | — | — |
| dlink | dcs-3430_firmware | — | — |
| dlink | dcs-5230_firmware | — | — |
| dlink | dcs-5230l_firmware | — | — |
| dlink | dcs-5605_firmware | — | — |
| dlink | dcs-5635_firmware | — | — |
| dlink | dcs-6410_firmware | — | — |
| dlink | dcs-7410_firmware | — | — |
| dlink | dcs-7510_firmware | — | — |
| dlink | wcs-1100_firmware | — | — |
Detection & IOCsextracted from sources · hover to see the quote
- →CVE-2013-1602: RTSP authentication bypass occurs because authentication is only enforced on DESCRIBE requests but not on every subsequent RTSP request; monitor for RTSP sessions where SETUP/PLAY requests lack valid authentication headers following a DESCRIBE. ↗
- →CVE-2013-1602: The RTSP session establishment reuses a previously stored authentication response rather than validating the current session's credentials; detect by inspecting RTSP session cookies for reuse across sessions. ↗
- →CVE-2013-1599 (related, same advisory): Detect HTTP GET requests to /cgi-bin/rtpd.cgi containing ampersand-delimited command tokens (e.g., semicolons and Unix commands) as OS command injection attempts. ↗
- ·The PoC exploit uses a TCP tunnel and UDP dispatcher proxy architecture to intercept and replay RTSP authentication cookies; the example IP 192.168.1.100 is a placeholder and will differ in real deployments. ↗
- ·CVE-2013-1602 affects ALL mentioned D-Link device/firmware combinations listed in the advisory, not just a subset; other SKUs not listed may also be affected but were not confirmed. ↗
CVSS provenance
nvdv3.17.5HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
nvdv2.05.0MEDIUMAV:N/AC:L/Au:N/C:P/I:N/A:N
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
No detection rules found.
Exploit-DB
Google Android - 'APK' code Remote Security Bypass
exploitdb·2013-07-03
CVE-2013-4787 Google Android - 'APK' code Remote Security Bypass
Google Android - 'APK' code Remote Security Bypass
---
#source: https://www.securityfocus.com/bid/60952/info
#
#Google Android is prone to a remote security-bypass vulnerability.
#
#Attackers can exploit this issue to bypass certain security restrictions to perform unauthorized actions. This may aid in further attacks.
#!/bin/bash
# PoC for Android bug 8219321 by @pof
# +info: https://jira.cyanogenmod.org/browse/CYAN-1602
if [ -z $1 ]; then echo "Usage: $0 " ; exit 1 ; fi
APK=$1
rm -r out out.apk tmp 2>/dev/null
java -jar apktool.jar d $APK out
#apktool d $APK out
echo "Modify files, when done type 'exit'"
cd out
bash
cd ..
java -jar apktool.jar b out out.apk
#apktool b out out.apk
mkdir tmp
cd tmp/
unzip ../$APK
mv ../out.apk .
cat >poc.py <<-EOF
#!/usr/bin/python
import zipfile
import
Exploit-DB
D-Link IP Cameras - Multiple Vulnerabilities
exploitdb·2013-05-01·CVSS 9.8
CVE-2013-1603 [CRITICAL] D-Link IP Cameras - Multiple Vulnerabilities
D-Link IP Cameras - Multiple Vulnerabilities
---
Core Security - Corelabs Advisory
http://corelabs.coresecurity.com/
D-Link IP Cameras Multiple Vulnerabilities
1. *Advisory Information*
Title: D-Link IP Cameras Multiple Vulnerabilities
Advisory ID: CORE-2013-0303
Advisory URL:
http://www.coresecurity.com/advisories/d-link-ip-cameras-multiple-vulnerabilities
Date published: 2013-04-29
Date of last update: 2013-03-29
Vendors contacted: D-Link Corporation
Release mode: Coordinated release
2. *Vulnerability Information*
Class: OS command injection [CWE-78], Authentication issues [CWE-287],
Information leak through GET request [CWE-598], Authentication issues
[CWE-287], Use of hard-coded credentials [CWE-798]
Impact: Code execution, Security bypass
Remotely Exploitable: Yes
Locally Explo
No writeups or analysis indexed.
http://www.securityfocus.com/bid/59569https://exchange.xforce.ibmcloud.com/vulnerabilities/83942https://packetstormsecurity.com/files/cve/CVE-2013-1602https://www.coresecurity.com/advisories/d-link-ip-cameras-multiple-vulnerabilitieshttp://www.securityfocus.com/bid/59569https://exchange.xforce.ibmcloud.com/vulnerabilities/83942https://packetstormsecurity.com/files/cve/CVE-2013-1602https://www.coresecurity.com/advisories/d-link-ip-cameras-multiple-vulnerabilities
2020-01-28
Published