Vin Ds783E E6
Monthly
Arbitrary file read in the Vacron VIN-DS783E-E6 device allows authenticated remote attackers to download arbitrary files from the underlying system by abusing relative path traversal (CWE-23). Any user with valid low-privilege credentials can escape the intended file-serving directory and retrieve sensitive system files such as configuration, credential, or password stores. No public exploit identified at time of analysis; the CVSS 4.0 score of 7.1 reflects network reachability, low attack complexity, and high confidentiality impact without integrity or availability effects.
Credential exposure in the Vacron VIN-DS783E-E6 network video/surveillance device lets unauthenticated remote attackers invoke an undocumented hidden function that returns the device administrator credentials, per a TWCERT-coordinated disclosure. Recovering the admin login yields complete takeover of the appliance (login, configuration, and video streams). No public exploit code has been identified at time of analysis, and the CVE is not listed in CISA KEV; no EPSS score was provided in the input.
Arbitrary file read in the Vacron VIN-DS783E-E6 device allows authenticated remote attackers to download arbitrary files from the underlying system by abusing relative path traversal (CWE-23). Any user with valid low-privilege credentials can escape the intended file-serving directory and retrieve sensitive system files such as configuration, credential, or password stores. No public exploit identified at time of analysis; the CVSS 4.0 score of 7.1 reflects network reachability, low attack complexity, and high confidentiality impact without integrity or availability effects.
Credential exposure in the Vacron VIN-DS783E-E6 network video/surveillance device lets unauthenticated remote attackers invoke an undocumented hidden function that returns the device administrator credentials, per a TWCERT-coordinated disclosure. Recovering the admin login yields complete takeover of the appliance (login, configuration, and video streams). No public exploit code has been identified at time of analysis, and the CVE is not listed in CISA KEV; no EPSS score was provided in the input.