CVE-2020-37157
DBPower C300 HD Camera - Remote Configuration Disclosure
- State
- Published
- Severity
- 8.7 High
- Published
- Feb 6, 2026
- Updated
- Feb 17, 2026
- Reserved
- Feb 3, 2026
Description
DBPower C300 HD Camera contains a configuration disclosure vulnerability that allows unauthenticated attackers to retrieve sensitive credentials through an unprotected configuration backup endpoint. Attackers can download the configuration file and extract hardcoded username and password by accessing the /tmpfs/config_backup.bin resource.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 8.7 High | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N | VulnCheck |
| 3.1 | 7.5 High | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N | VulnCheck |
Weaknesses
- CWE-306 Missing Authentication for Critical Function
Affected Products
| Product | Versions |
|---|---|
DBPower C300 HD CameraDBPower |
|
References
- ExploitDB-48095exploit
- Archived Researcher Blogtechnical-descriptionexploit
- VulnCheck Advisory: DBPower C300 HD Camera - Remote Configuration Disclosurethird-party-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.