CVE-2013-1391: Authentication bypass in CCTV DVR web interfaces exposes device configuration

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: medium.

high priorityUnauthenticated remote configuration disclosure with a high CVSS score and very high EPSS, though not observed in KEV or ransomware campaigns.

What it is

The web interface of DVR systems from Hunt, Capture, Hachi, NoVus and Well-Vision fails to properly authenticate requests, allowing an unauthenticated remote attacker to retrieve the device configuration. Because the flaw affects many DVR models across multiple brands, any internet-exposed unit is at risk of leaking sensitive configuration data.

Impact

An attacker gains the device configuration without credentials, which can expose administrative settings, network details and stored credentials that enable further compromise of the DVR and its network.

Attack surface

Reachable over the network through the DVR web interface with no authentication and no user interaction required, as reflected by the CVSS vector AV:N/AC:L/PR:N/UI:N.

Exploitation

Not listed in CISA KEV, but EPSS is very high (0.761, 99.5th percentile) and multiple references are tagged Exploit, including a Rapid7 scanner module, indicating public exploitation tooling exists.

What to do

• Apply vendor firmware updates for the affected DVR models; if no fix is available, replace or isolate the devices.
• Remove DVR web interfaces from direct internet exposure and place them behind a VPN or firewall with strict allowlists.
• Change default and shared credentials and disable unused remote management features.
• Segment DVR and camera networks from general corporate and user networks.
• Monitor vendor advisories for these brands since support may be limited or discontinued.

Detection

• Search web or proxy logs for requests to DVR configuration endpoints from unexpected external or internal sources.
• Run the Rapid7 dvr_config_disclosure scanner against owned DVRs to identify exposed units.
• Alert on outbound connections from DVR devices to unfamiliar hosts, which may indicate configuration exfiltration.
• Inventory internet-facing DVR web interfaces and review authentication logs for access without prior login.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.