{"resultsPerPage":1,"startIndex":0,"totalResults":1,"format":"NVD_CVE","version":"2.0","timestamp":"2026-04-18T16:43:31.956","vulnerabilities":[{"cve":{"id":"CVE-2020-11680","sourceIdentifier":"cve@mitre.org","published":"2020-06-04T19:15:12.773","lastModified":"2024-11-21T04:58:23.167","vulnStatus":"Modified","cveTags":[],"descriptions":[{"lang":"en","value":"Castel NextGen DVR v1.0.0 is vulnerable to authorization bypass on all administrator functionality. The application fails to check that a request was submitted by an administrator. Consequently, a normal user can perform actions including, but not limited to, creating/modifying the file store, creating/modifying alerts, creating/modifying users, etc."},{"lang":"es","value":"Castel NextGen DVR versión v1.0.0, es vulnerable a una omisión de autorización en todas las funcionalidades del administrador. La aplicación presenta un fallo al comprobar que un administrador haya enviado una petición. En consecuencia, un usuario normal puede llevar a cabo acciones que incluyen, entre otras, crear y modificar el almacén de archivos, crear y modificar alertas, crear y modificar usuarios, etc"}],"metrics":{"cvssMetricV31":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":3.6}],"cvssMetricV2":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:S/C:N/I:P/A:N","baseScore":4.0,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"SINGLE","confidentialityImpact":"NONE","integrityImpact":"PARTIAL","availabilityImpact":"NONE"},"baseSeverity":"MEDIUM","exploitabilityScore":8.0,"impactScore":2.9,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}]},"weaknesses":[{"source":"nvd@nist.gov","type":"Primary","description":[{"lang":"en","value":"CWE-862"}]}],"configurations":[{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:castel:nextgen_dvr_firmware:1.0.0:*:*:*:*:*:*:*","matchCriteriaId":"B8F4BE34-AC2F-4FE9-BDDE-C9E88FA59A0A"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:castel:nextgen_dvr:-:*:*:*:*:*:*:*","matchCriteriaId":"A3513CE5-CB6F-43C0-B37A-D135C027310B"}]}]}],"references":[{"url":"http://packetstormsecurity.com/files/157954/Castel-NextGen-DVR-1.0.0-Bypass-CSRF-Disclosure.html","source":"cve@mitre.org","tags":["Third Party Advisory"]},{"url":"http://seclists.org/fulldisclosure/2020/Jun/8","source":"cve@mitre.org","tags":["Mailing List","Third Party Advisory"]},{"url":"https://www.securitymetrics.com/blog/attackers-known-unknown-authorization-bypass","source":"cve@mitre.org","tags":["Third Party Advisory"]},{"url":"http://packetstormsecurity.com/files/157954/Castel-NextGen-DVR-1.0.0-Bypass-CSRF-Disclosure.html","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory"]},{"url":"http://seclists.org/fulldisclosure/2020/Jun/8","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Mailing List","Third Party Advisory"]},{"url":"https://www.securitymetrics.com/blog/attackers-known-unknown-authorization-bypass","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory"]}]}}]}