CVE-2019-25240

CVE-2019-25240 is an unauthenticated vulnerability in the Rifatron 5brid DVR, specifically affecting the animate.cgi script within the Mobile Web Viewer module. This flaw allows attackers to access live video streams by specifying channel numbers to retrieve sequential video snapshots without any authentication, violating CWE-306 (Missing Authentication for Critical Function). The vulnerability carries a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), indicating critical severity due to its remote, low-complexity exploitation potential with high impacts on confidentiality, integrity, and availability.

Any network-accessible attacker can exploit this vulnerability without privileges or user interaction, simply by sending crafted requests to the animate.cgi endpoint with channel parameters. Successful exploitation grants unauthorized viewing of live video feeds from the DVR's channels, potentially exposing sensitive surveillance footage.

Advisories and proof-of-concept exploits are documented in references including the vendor site at http://www.rifatron.com, Exploit-DB at https://www.exploit-db.com/exploits/47368, and Zero Science Labs at https://www.zeroscience.mk/en/vulnerabilities/ZSL-2019-5532.php, which provide further details on the issue though specific mitigation or patch guidance is not detailed in the CVE record.