An authenticated file disclosure vulnerability in the Beward N100 H.264 VGA IP camera allows attackers to access sensitive system files, posing a significant risk to device integrity and confidentiality.

The device suffers from a path traversal vulnerability (CWE-22) in the fileread script and SendCGICMD API. An authenticated attacker can manipulate the READ.filePath parameter to escape the intended directory and retrieve sensitive files, such as /etc/passwd.

Successful exploitation allows unauthorized access to critical configuration files and system credentials. This compromise can lead to full device takeover, enabling an attacker to pivot into the internal network or conduct persistent surveillance, which justifies the high CVSS score of 8.8.

Immediate Action: Contact the vendor immediately to determine if a firmware update is available for your specific device configuration, as no public patch is currently documented for this specific version.

Proactive Monitoring: Review web server and access logs for suspicious requests containing path traversal sequences, such as "../", directed at the cgi-bin directory.

Compensating Controls: Restrict management access to the device to a dedicated, isolated management network or use a Web Application Firewall (WAF) to filter and block requests containing directory traversal characters in the READ.filePath parameter.

Public Exploit Available: Yes, a published proof-of-concept exists as documented in the Exploit-DB entry 46320.

Given the high severity and the availability of public exploit code, administrators must prioritize restricting access to this device. Since a direct patch may not be readily available, network-level isolation remains the most effective method to prevent unauthorized access and potential exploitation of this flaw.