CVE-2019-25240 | Rifatron 5brid DVR contains an unauthenticated vulnerability… | CVSS 9.8 CRITICAL

Description

Rifatron 5brid DVR contains an unauthenticated vulnerability in the animate.cgi script that allows unauthorized access to live video streams. Attackers can exploit the Mobile Web Viewer module by specifying channel numbers to retrieve sequential video snapshots without authentication.

Metadata

CVE ID: CVE-2019-25240
State: PUBLISHED
Assigner: VulnCheck
Reserved: 2025-12-24 14:27 UTC
Published: 2025-12-24 19:27 UTC
Last updated: 2025-12-24 20:23 UTC
Primary CWE: CWE-306
Missing Authentication for Critical Function
Vendor / Product: Rifatron Co., Ltd. / DVR
Sources: cve.org · NVD

Severity & Metrics

9.8 CRITICAL CVSS 3.1

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

SSVC — CISA Coordinator

Exploitation: PoC
Automatable: yes
Tech. Impact: partial

Affected products (1)

Vendor	Product	Platform	Versions
Rifatron Co., Ltd.	DVR	—	5brid DVR (HD6-532/516, DX6-516/508/504, MX6-516/508/504, EH6-504), 7brid DVR (HD3-16V2, DX3-16V2/08V2/04V2, MX3-08V2/04V2), Firmware: <=8.0 (000143)

Weakness (CWE)

CWE	Source	Description
CWE-306	cna	Missing Authentication for Critical Function

CVSS scores (2)

Score	Severity	Version	Source	Vector
9.8	CRITICAL	3.1	cna	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
8.7	HIGH	4.0	cna	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

References (3)

ExploitDB-47368 https://www.exploit-db.com/exploits/47368
Rifatron Official Product Homepage http://www.rifatron.com
Zero Science Lab Disclosure (ZSL-2019-5532) https://www.zeroscience.mk/en/vulnerabilities/ZSL-2019-5532.php