LH340-Series 960H security video recorder Edge 3 series (2 devices affected) List of vulnerable device families and URL for firmware download MITRE assigns CVE-2014-1201 to this issue. Third email to sales saying that technical support never contacted me back. Second email to sales, received response by sales saying they will forward it to technical support and get back to me. I have contacted Lorex and they initially said they would fix it, but went radio silent shortly afterwards. To do so, please follow the instructions in, and then install the ActiveX control in INetViewProj1_02030330.cab. To verify this vulnerability you can download and extract the firmware using binwalk (). Win 7 圆4 with IE10 fully patched - Fully exploitable, though not as easy as for XP (see analyze -v and !exploitable outputs) Win XP SP3 with IE8 - Could not get it to crash (?) Win XP SP3 with IE6 - Fully exploitable as described The list below tells a better story about what is affected and how it can be controlled: Changing the four A's to any other value will cause EIP to crash on that value.

If you open this file in IE after installing the control, you will see that IE will crash with an EIP of 0x41414141. You will see that the HTTP_PORT parameter is composed of D's, apart from chars 109 to 113 which are four A's. Please refer to the PoC file lorex-testcase.html. The instruction pointer can be very easily controlled in XP by the characters 109 to 113 in the string. The buffer overflow can be triggered by a really long string (10000+ characters) in the HTTP_PORT parameter. Their products offer remote video viewing capabilities, and you can find some of them on Shodan.

The full list of devices, as well as links to the firware download, can be found in. The Lorex manual instructs the user to blindly accept the ActiveX control install when prompted. These security DVR's are remotely accessible, and when you access it on a Windows computer with Internet Explorer, they try to install the vulnerable ActiveX control INetViewX. I have confirmed that all 16 are vulnerable at this point in time. Their affected product range is the EDGE series, which has 16 products in it.

The company is Lorex Technologies, a major video surveillance manufacturer that is very popular in the US and East Asia. I have discovered a buffer overflow vulnerability that allows remote code execution in an ActiveX control bundled by a manufacturer of video surveillance systems.

Activex camera dvr linux