Vendor
An unauthenticated credential disclosure vulnerability in various DVR devices allows attackers to retrieve administrative credentials via the /device.rsp endpoint.