Secunia

A vulnerability has been reported in FlexWATCH Network Video Server, which can be exploited by malicious people to bypass the user authentication and gain administrative access.

The vulnerability is caused due to an error when determining access rights to restricted resources. This can be exploited to bypass the authentication process completely by appending an extra "/" character after the FQDN (Fully-Qualified Domain Name) when accessing a resource.

Example:
http://[victim]//admin/aindex.htm

The vulnerability has been reported in FlexWATCH Network Video Server Model 132 firmware version 2.2. Other versions and products may also be affected.

Solution
Restrict access to the web interface allowing only trusted IPs to connect.

Provided and/or discovered by
Slaizer

Original Advisory
Unauthorized access Vulnerability in FlexWATCH camera Server:
http://packetstorm.linuxsecurity.com/0310-exploits/FlexWATCH.txt

Deep Links
Links available in Customer Area