Test ID:	1.3.6.1.4.1.25623.1.0.103770
Category:	Web application abuses
Title:	Samsung DVR Authentication Bypass
Summary:	The remote Samsung DVR is prone to an Authentication Bypass.
Description:	Summary: The remote Samsung DVR is prone to an Authentication Bypass. Vulnerability Insight: In most of the CGIs on the Samsung DVR, the session check is made in a wrong way, that allows to access protected pages simply putting an arbitrary cookie into the HTTP request. Vulnerability Impact: This vulnerability allows remote unauthenticated users to: - Get/set/delete username/password of local users (/cgi-bin/setup_user) - Get/set DVR/Camera general configuration - Get info about the device/storage - Get/set the NTP server - Get/set many other settings. Affected Software/OS: Samsung DVR with firmware version <= 1.10. Solution: Ask the Vendor for an update. CVSS Score: 7.6 CVSS Vector: AV:N/AC:H/Au:N/C:C/I:C/A:C
Cross-Ref:	Common Vulnerability Exposure (CVE) ID: CVE-2013-3585 CERT/CC vulnerability note: VU#882286 http://www.kb.cert.org/vuls/id/882286 Common Vulnerability Exposure (CVE) ID: CVE-2013-3586
Copyright	Copyright (C) 2013 Greenbone AG

This is only one of 145615 vulnerability tests in our test suite. Find out more about running a complete security audit. To run a free test of this vulnerability against your system, register below.