CVE-2020-36925
Critical
Description
Arteco Web Client DVR/NVR contains a session hijacking vulnerability with insufficient session ID complexity that allows remote attackers to bypass authentication. Attackers can brute force session IDs within a specific numeric range to obtain valid sessions and access live camera streams without authorization.
SeverityCritical
CVSS9.8
Exploit probability—
ProductArteco Web Client DVR/NVR
PublishedJan 6, 2026
First seenJan 6, 2026
Weakness typeCWE-331CWE-331
How to fix
Sources list no fixed version or patch link for this vulnerability.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| Arteco-Global Arteco Web Client DVR/NVR | No range specified | — |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.