CVE-2020-11625

PoC —

CVSS 3.1

5.3 medium

EPSS

1%p71

Published

Jul 23, 2020 (Jul 23, 2020)

Modified

Jun 17, 2026

Description

An issue was discovered in AvertX Auto focus Night Vision HD Indoor/Outdoor IP Dome Camera HD838 and Night Vision HD Indoor/Outdoor Mini IP Bullet Camera HD438. Failed web UI login attempts elicit different responses depending on whether a user account exists. Because the responses indicate whether a submitted username is valid or not, they make it easier to identify legitimate usernames. If a login request is sent to ISAPI/Security/sessionLogin/capabilities using a username that exists, it will return the value of the salt given to that username, even if the password is incorrect. However, if a login request is sent using a username that is not present in the database, it will return an empty salt value. This allows attackers to enumerate legitimate usernames, facilitating brute-force attacks. NOTE: this is different from CVE-2020-7057.

Vendors: avertx
Products: hd838 firmware, hd438 firmware
Weakness: CWE-203
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

NVD CVE.org GitHub PoCs EPSS (1.4%)

In the news1 stories

3 Vulnerabilities Found on AvertX IP Cameras

Unit 42 disclosed three vulnerabilities (CVE-2020-11623/4/5) in AvertX HD838 and 438IR IP cameras; AvertX has released patches.

Palo Alto Networks Unit 42 researchers found three vulnerabilities in AvertX HD838 and 438IR outdoor surveillance cameras, which are rebranded Hikvision products: CVE-2020-11625 (user enumeration), CVE-2020-11624 (weak password requirements), and CVE-2020-11623 (exposed dangerous method/function). User enumeration responses facilitate brute-force attacks, the default admin credentials (admin/1234) are never enforced to change, and physical access to an exposed UART interface allows bootloader access and configuration modification. AvertX released a patch, removed the UART connector, and disabled the interface in the latest production batch.

Palo Alto Unit 42Aug 18, 04:45 UTC · 28d agoVulnerability CVE-2020-11625 CVE-2020-11624 CVE-2020-11623