Security readout for executives and security teams
Plain-English summary
ACE SECURITY WIP-90113 HD cameras are reported to expose a configuration backup without authentication. That backup may contain administrative credentials and sensitive device settings, which could help an unauthenticated remote attacker take further action against the camera or the surrounding network.
Executive priority
Prioritize remediation for any internet-facing or broadly reachable WIP-90113 cameras. The main business risk is credential and configuration disclosure leading to follow-on compromise, and the bundle does not provide patch evidence, so exposure reduction should be immediate.
Technical view
CVE-2020-36874 is an unauthenticated configuration disclosure issue in the /web/cgi-bin/hi3510/backup.cgi endpoint of ACE SECURITY WIP-90113 HD Camera. The source bundle maps this to CWE-306 and CVSS 4.0 score 8.7 with network attack vector, low complexity, no privileges, and no user interaction. The affected entry lists ACE SECURITY WIP-90113 HD Camera version "0" with default status unknown; the bundle does not provide confirmed firmware ranges or patch details.
Likely exposure
Highest risk applies to ACE SECURITY WIP-90113 HD cameras reachable from the internet or from untrusted internal networks. Exposure is especially concerning where camera management interfaces are accessible without VPN, firewall controls, or network segmentation.
Exploitation context
The bundle includes references tagged as exploit sources from Packet Storm and CXSecurity, indicating public exploit information exists. The bundle marks KEV as false and does not provide evidence of active exploitation, so active exploitation should not be assumed from this data alone.
Researcher notes
Do not infer broader ACE SECURITY product impact from this bundle. Do not assume active exploitation because KEV is false and the provided sources do not state active exploitation. Patch status is unclear; validate against current vendor guidance before declaring a fixed version.
Mitigation direction
- Remove direct internet exposure for affected camera management interfaces.
- Restrict access to trusted administrative networks or VPN-only paths.
- Segment cameras from user workstations, servers, and sensitive internal systems.
- Rotate camera administrative credentials and any reused credentials if configuration backup exposure is suspected.
- Review vendor guidance for supported firmware, configuration changes, or replacement options; patch evidence is not provided in the bundle.
- If no vendor fix is available, consider decommissioning or replacing exposed devices.
Validation and detection
- Inventory ACE SECURITY WIP-90113 HD cameras and record firmware or software versions from trusted administrative sources.
- Confirm whether camera management interfaces are reachable from untrusted networks using approved internal validation processes.
- Verify that configuration backup access requires authentication after mitigation.
- Review network, firewall, and camera logs for suspicious access to configuration backup functionality.
- Check whether credentials or sensitive settings from camera configurations were reused elsewhere and rotate them where needed.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-306: Credential and account abuse lookup
Authentication and credential weaknesses can make valid-account abuse and credential telemetry useful review starting points. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2020-36874 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 8.7 (4.0)
- Known Exploited
- No
- Published
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N——Primary CVE scoreVulnerability scoring details
Base CVSS 4.0 score
8.7HighVector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
Source materials
- CVE List V5 sourceCVE List V5
- https://packetstorm.news/files/id/156497/CVE reference · exploit
- https://cxsecurity.com/issue/WLB-2020020137CVE reference · exploit
- https://acesecurity.jp/support/top/wip_series/wip-90113CVE reference · product
- https://www.vulncheck.com/advisories/ace-security-wip90113-unauthenticated-config-disclosureCVE reference · third-party-advisory
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Missing Authentication for Critical Function
Missing Authentication for Critical Function represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.