CVE-2022-4621

🗓️ 17 Jan 2023 16:36:58Reported by icscertType

cve🔗 web.nvd.nist.gov👁 65 Views🌐 WEB

Panasonic Sanyo CCTV Network Cameras versions 1.02-05 and 2.03-0x vulnerable to CSRF

Reporter	Title	Published	Views	Family All 10
Circl	CVE-2022-4621	17 Jan 202320:40	–	circl
CNNVD	多款Panasonic产品跨站请求伪造漏洞	17 Jan 202300:00	–	cnnvd
Cvelist	CVE-2022-4621 Panasonic Sanyo CCTV Network Camera	17 Jan 202316:36	–	cvelist
EUVD	EUVD-2022-51951	3 Oct 202520:07	–	euvd
ICS	Panasonic Sanyo CCTV Network Camera	12 Jan 202300:00	–	ics
NVD	CVE-2022-4621	17 Jan 202317:15	–	nvd
Prion	Code injection	17 Jan 202317:15	–	prion
Positive Technologies	PT-2023-14847 · Panasonic · Panasonic Sanyo Cctv Network Cameras	17 Jan 202300:00	–	ptsecurity
Vulnrichment	CVE-2022-4621 Panasonic Sanyo CCTV Network Camera	17 Jan 202316:36	–	vulnrichment
Zero Science Lab	Panasonic Sanyo CCTV Network Camera 2.03-0x CSRF Disable Authentication / Change Password	30 Jul 202100:00	–	zeroscience

NVD

Vulners

Node

panasonic vcc-hd5600p_firmwareMatch2.03-06

AND

panasonic vcc-hd5600pMatch-

Node

panasonic vcc-hd3300p_firmwareMatch1.02-05

panasonic vcc-hd3300p_firmwareMatch2.03-08

AND

panasonic vcc-hd3300pMatch-

Node

panasonic vcc-hd3300_firmwareMatch2.03-02

AND

panasonic vcc-hd3300Match-

Node

panasonic vcc-hd2100p_firmwareMatch2.03-02

AND

panasonic vcc-hd2100pMatch-

Node

panasonic vcc-hd3100p_firmwareMatch2.03-00

AND

panasonic vcc-hd3100pMatch-

[
  {
    "defaultStatus": "unaffected",
    "product": "Sanyo CCTV Network Camera",
    "vendor": "Panasonic",
    "versions": [
      {
        "status": "affected",
        "version": "VCC-HD5600P version 2.03-06 "
      },
      {
        "status": "affected",
        "version": "VDC-HD3300P version 2.03-08  "
      },
      {
        "status": "affected",
        "version": "VDC-HD3300P version 1.02-05 "
      },
      {
        "status": "affected",
        "version": "VCC-HD3300 version 2.03-02 "
      },
      {
        "status": "affected",
        "version": "VDC-HD3100P version 2.03-00 "
      },
      {
        "status": "affected",
        "version": "VCC-HD2100P version 2.03-02  "
      }
    ]
  }
]

Source	Link
archives	www.archives.connect.panasonic.com/security/sanyo/index.html
cisa	www.cisa.gov/uscert/ics/advisories/icsa-23-012-04

Parameter	Position	Path	Description	CWE
anonymous_sw	request body	/cgi-bin/user_registration.cgi	CSRF vulnerability enabling privileged actions (change admin credentials) via forged requests.	CWE-352
admin1_pw	request body	/cgi-bin/user_registration.cgi	CSRF vulnerability enabling privileged actions (change admin credentials) via forged requests.	CWE-352
admin2_pw	request body	/cgi-bin/user_registration.cgi	CSRF vulnerability enabling privileged actions (change admin credentials) via forged requests.	CWE-352
admin3_pw	request body	/cgi-bin/user_registration.cgi	CSRF vulnerability enabling privileged actions (change admin credentials) via forged requests.	CWE-352
operator_pw	request body	/cgi-bin/user_registration.cgi	CSRF vulnerability enabling privileged actions (change admin credentials) via forged requests.	CWE-352
guest_pw	request body	/cgi-bin/user_registration.cgi	CSRF vulnerability enabling privileged actions (change admin credentials) via forged requests.	CWE-352

21 Nov 2024 07:35Current

8.2High risk

Vulners AI Score8.2

CVSS 3.17.5 - 8.8

EPSS0.00109

SSVC

CWE-352