This host is running AVTECH DVR and is prone to multiple vulnerabilities.

Successful exploitation will allow remote attacker to bypass CAPTCHA requests, cause a buffer overflow resulting in a denial of service or potentially allowing the execution of arbitrary code. Impact Level: System/Application

No solution or patch was made available for at least one year since disclosure of this vulnerability. Likely none will be provided anymore. General solution options are to upgrade to a newer release, disable respective features, remove the product or replace the product by another one.

Multiple flaws are due to, - The device sending 10 hardcoded CAPTCHA requests after an initial purposefully false CAPTCHA request. - An user-supplied input is not properly validated when handling RTSP transactions. - An user-supplied input is not properly validated when handling input passed via the 'Network.SMTP.Receivers' parameter to the /cgi-bin/user/Config.cgi script.

DVR 4CH H.264 (AVTECH AVN801) firmware 1017-1003-1009-1003

Send crafted HTTP GET request and check it is possible bypass the captcha verification or not.

• http://seclists.org/fulldisclosure/2013/Aug/284
• http://www.coresecurity.com/advisories/avtech-dvr-multiple-vulnerabilities
• http://www.exploit-db.com/exploits/27942
• http://www.osvdb.org/96692
• http://www.osvdb.org/96693
• http://www.osvdb.org/96698

---

Updated on 2015-03-25