[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"cve-CVE-2020-11625":3},{"id":4,"cve_id":5,"euvd_id":6,"summary":7,"published":8,"cvss_data":9,"is_remote":24,"cwes":25,"cpes":27,"technologies":32,"references":37,"score":39,"epss_score":40,"epss_percentile":41,"is_kev":42,"cisa_kev_date_added":43,"cisa_kev_due_date":43,"cisa_ssvc":44,"attack_mappings":50,"exploits":57},269331,"CVE-2020-11625","EUVD-2020-3970","An issue was discovered in AvertX Auto focus Night Vision HD Indoor\u002FOutdoor IP Dome Camera HD838 and Night Vision HD Indoor\u002FOutdoor Mini IP Bullet Camera HD438. Failed web UI login attempts elicit different responses depending on whether a user account exists. Because the responses indicate whether a submitted username is valid or not, they make it easier to identify legitimate usernames. If a login request is sent to ISAPI\u002FSecurity\u002FsessionLogin\u002Fcapabilities using a username that exists, it will return the value of the salt given to that username, even if the password is incorrect. However, if a login request is sent using a username that is not present in the database, it will return an empty salt value. This allows attackers to enumerate legitimate usernames, facilitating brute-force attacks. NOTE: this is different from CVE-2020-7057.","2020-07-23T21:15:00Z",{"cvss_v2.0":10,"cvss_v3.1":18},{"version":11,"baseScore":12,"accessVector":13,"vectorString":14,"authentication":15,"integrityImpact":15,"accessComplexity":16,"availabilityImpact":15,"confidentialityImpact":17},"2.0",5,"NETWORK","AV:N\u002FAC:L\u002FAu:N\u002FC:P\u002FI:N\u002FA:N","NONE","LOW","PARTIAL",{"scope":19,"version":20,"baseScore":21,"attackVector":13,"baseSeverity":22,"vectorString":23,"integrityImpact":15,"userInteraction":15,"attackComplexity":16,"availabilityImpact":15,"privilegesRequired":15,"confidentialityImpact":16},"UNCHANGED","3.1",5.3,"MEDIUM","CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:N\u002FUI:N\u002FS:U\u002FC:L\u002FI:N\u002FA:N",true,[26],"CWE-203",[28,29,30,31],"cpe:2.3:h:avertx:hd838:-:*:*:*:*:*:*:*","cpe:2.3:o:avertx:hd438_firmware:-:*:*:*:*:*:*:*","cpe:2.3:o:avertx:hd838_firmware:-:*:*:*:*:*:*:*","cpe:2.3:h:avertx:hd438:-:*:*:*:*:*:*:*",[33,34,35,36],"Avertx Hd838 Firmware","Avertx Hd438","Avertx Hd438 Firmware","Avertx Hd838",[38],"https:\u002F\u002Funit42.paloaltonetworks.com\u002Favertx-ip-cameras-vulnerabilities\u002F",0.62,0.01376,0.71856,false,null,{"timestamp":43,"automatable":45,"tech_impact":46,"exploitation":47,"cisa_decision":48,"cisa_remediation_timeline":49},"no","partial","none",{},"FSU",[51],{"name":52,"source":53,"tactics":54,"technique_id":56},"Exploit Public-Facing Application","attack_vector",[55],"initial-access","T1190",[58],{"link":38}]