Published

4 January 2008

Last modified

16 June 2026

CVSS

10.0 v2.0

Severity

high

EPSS

12.6% (96th pct)

CISA KEV

Not listed

NVD status

Modified

Weaknesses

CWE-264

AV:N/AC:L/Au:N/C:C/I:C/A:C

Description

March Networks DVR 3204 stores sensitive information under the web root with insufficient access control, which allows remote attackers to obtain usernames, passwords, device names, and IP addresses via a direct request for scripts/logfiles.tar.gz.

Exploitation

Not listed in the CISA Known Exploited Vulnerabilities catalogue as of 2026.09.04. That is an absence of confirmed public exploitation, not evidence that exploitation has not occurred. EPSS models a 12.6% probability of exploitation activity in the next 30 days, placing it in the top decile of all scored CVEs.

Affected products

References

Vendor advisory and patch

• http://secunia.com/advisories/28211
• http://secunia.com/advisories/28211

• http://osvdb.org/39726
• http://www.milw0rm.com/papers/190
• http://www.securityfocus.com/bid/27054 exploit
• http://www.sybsecurity.com/advisors/SYBSEC-ADV14-March_Networks_DVR_3204_Logfile_Information_Disclosure
• http://www.sybsecurity.com/pages/advisors/static/dvr3204_exp.txt
• http://www.sybsecurity.com/resources/static/An_Insecurity_Overview_of_the_March_Networks_DVR-CCTV_3204.pdf
• https://www.exploit-db.com/exploits/4797
• http://osvdb.org/39726
• http://www.milw0rm.com/papers/190
• http://www.securityfocus.com/bid/27054 exploit
• http://www.sybsecurity.com/advisors/SYBSEC-ADV14-March_Networks_DVR_3204_Logfile_Information_Disclosure
• http://www.sybsecurity.com/pages/advisors/static/dvr3204_exp.txt
• http://www.sybsecurity.com/resources/static/An_Insecurity_Overview_of_the_March_Networks_DVR-CCTV_3204.pdf
• https://www.exploit-db.com/exploits/4797

CVE-2007-6638 at NVD

Record assembled from NVD, CISA KEV 2026.09.04 and FIRST EPSS 2026-09-04. Affected products are those NVD's CPE configuration names that fall inside this site's scope; a CVE may affect products outside it.