The remote Samsung DVR is prone to an Authentication Bypass.

This vulnerability allows remote unauthenticated users to: - Get/set/delete username/password of local users (/cgi-bin/setup_user) - Get/set DVR/Camera general configuration - Get info about the device/storage - Get/set the NTP server - Get/set many other settings Impact Level: Application

Ask the Vendor for an update.

In most of the CGIs on the Samsung DVR, the session check is made in a wrong way, that allows to access protected pages simply putting an arbitrary cookie into the HTTP request.

Samsung DVR with firmware version <= 1.10

Check if /cgi-bin/setup_user is accessible without authentication

• http://www.andreafabrizi.it/?exploits:samsung:dvr
• http://www.exploit-db.com/exploits/27753
• http://www.kb.cert.org/vuls/id/882286
• http://www.osvdb.com/96509
• http://www.osvdb.com/96510

---

Updated on 2015-03-25