CVE-2019-25246
Beward N100 H.264 VGA IP Camera M2.1.6 Authenticated File Disclosure
- State
- Published
- Severity
- 7.1 High
- Published
- Dec 24, 2025
- Updated
- Dec 24, 2025
- Reserved
- Dec 24, 2025
Description
Beward N100 H.264 VGA IP Camera M2.1.6 contains an authenticated file disclosure vulnerability that allows attackers to read arbitrary system files via the 'READ.filePath' parameter. Attackers can exploit the fileread script or SendCGICMD API to access sensitive files like /etc/passwd and /etc/issue by supplying absolute file paths.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 7.1 High | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N | VulnCheck |
| 3.1 | 8.8 High | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H | VulnCheck |
Weaknesses
- CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Affected Products
| Product | Versions |
|---|---|
N100 H.264 VGA IP CameraBeward R&D Co., Ltd |
|
References
- ExploitDB-46320exploit
- Beward Product Homepageproduct
- Zero Science Lab Disclosure (ZSL-2019-5511)third-party-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.