Lucene search

TwcertCVE-2022-47618

HistoryJan 03, 2023 - 3:15 a.m.

CVE-2022-47618

2023-01-0303:15:10

CWE-798

twcert

web.nvd.nist.gov

cve-2022-47618

merit lilin

ah55b04

ah55b08

dvr

hard-coded credentials

administrator

remote attacker

system manipulation

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

9.4

Confidence

High

EPSS

0.004

Percentile

72.9%

JSON

Merit LILIN AH55B04 & AH55B08 DVR firm has hard-coded administrator credentials. An unauthenticated remote attacker can use these credentials to log in administrator page, to manipulate system or disrupt service.

Affected configurations

Nvd

Node

meritlilinah55b08Match-

AND

meritlilinah55b08_firmwareMatch-

Node

meritlilinah55b04Match-

AND

meritlilinah55b04_firmwareMatch-

VendorProductVersionCPE
meritlilinah55b08-cpe:2.3:h:meritlilin:ah55b08:-:*:*:*:*:*:*:*
meritlilinah55b08_firmware-cpe:2.3:o:meritlilin:ah55b08_firmware:-:*:*:*:*:*:*:*
meritlilinah55b04-cpe:2.3:h:meritlilin:ah55b04:-:*:*:*:*:*:*:*
meritlilinah55b04_firmware-cpe:2.3:o:meritlilin:ah55b04_firmware:-:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
meritlilin	ah55b08	-	cpe:2.3:h:meritlilin:ah55b08:-:::::::*
meritlilin	ah55b08_firmware	-	cpe:2.3:o:meritlilin:ah55b08_firmware:-:::::::*
meritlilin	ah55b04	-	cpe:2.3:h:meritlilin:ah55b04:-:::::::*
meritlilin	ah55b04_firmware	-	cpe:2.3:o:meritlilin:ah55b04_firmware:-:::::::*

CNA Affected

[
  {
    "vendor": "Merit Lilin Ent. Co., Ltd.",
    "product": "AH55B04 DVR firmware",
    "versions": [
      {
        "version": "unspecified",
        "lessThanOrEqual": "SVN#7570",
        "status": "affected",
        "versionType": "custom"
      }
    ]
  },
  {
    "vendor": "Merit Lilin Ent. Co., Ltd.",
    "product": "AH55B08 DVR firmware",
    "versions": [
      {
        "version": "unspecified",
        "lessThanOrEqual": "SVN#7570",
        "status": "affected",
        "versionType": "custom"
      }
    ]
  }
]

References

www.twcert.org.tw/tw/cp-132-6825-6691e-1.html

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

9.4

Confidence

High

EPSS

0.004

Percentile

72.9%

JSON

Related for CVE-2022-47618