CVE-2018-15745: Argus Surveillance DVR unauthenticated path traversal file disclosure

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: medium.

high priorityUnauthenticated remote file disclosure with a high CVSS score and very high EPSS probability, though no KEV listing or confirmed in-the-wild exploitation is recorded.

What it is

Argus Surveillance DVR 4.0.0.0 exposes a directory traversal flaw in the WEBACCOUNT.CGI RESULTPAGE parameter, where a ..%2F sequence lets a remote client read files outside the intended web root. Because the request needs no authentication, any network-reachable device is exposed. The record names only version 4.0.0.0 and does not list other affected builds.

Impact

An attacker gains read access to arbitrary files on the DVR filesystem, which can expose credentials, configuration and recorded data. There is no write or code execution impact in the CVSS vector, so the primary loss is confidentiality.

Attack surface

Reached over the network through HTTP requests to WEBACCOUNT.CGI with a crafted RESULTPAGE parameter. No authentication and no user interaction are required per the CVSS vector and description.

Exploitation

Public exploit references exist (Exploit-DB 45296 and vendor advisory), and EPSS is 0.977 with a 0.999 percentile, indicating high predicted exploitation activity. The CVE is not listed in CISA KEV, so no confirmed in-the-wild use is recorded here.

What to do

• Apply the vendor patch or firmware update for Argus Surveillance DVR if one is available; the record does not name a fixed version.
• If no patch exists, isolate DVR devices on a segmented VLAN and block direct internet access.
• Restrict access to WEBACCOUNT.CGI and the DVR web interface to trusted management hosts only.
• Replace end-of-life DVR units that no longer receive security updates.
• Monitor vendor advisories for a fixed release since this record does not specify one.

Detection

• Search web and proxy logs for requests to WEBACCOUNT.CGI containing ..%2F or ../ sequences in the RESULTPAGE parameter.
• Alert on HTTP 200 responses to WEBACCOUNT.CGI from untrusted or external source IPs.
• Baseline normal DVR web traffic and flag anomalous file-path patterns or repeated traversal attempts.
• Review DVR device logs for unexpected file reads or access to configuration and credential files.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.