An authentication bypass vulnerability exists in AVTECH IP camera, DVR, and NVR devices’ streamd web server. The strstr() function is used to identify .cab requests, allowing any URL containing .cab to bypass authentication and access protected endpoints.
This attack-focused weakness is caused by incorrectly implemented authentication schemes that are subject to spoofing attacks.