Uniview IP Cameras Classic Buffer Overflow (CVE-2021-45039)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(506028);
  script_version("1.1");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/10/02");

  script_cve_id("CVE-2021-45039");

  script_name(english:"Uniview IP Cameras Classic Buffer Overflow (CVE-2021-45039)");

  script_set_attribute(attribute:"synopsis", value:
"The remote OT asset is affected by a vulnerability.");
  script_set_attribute(attribute:"description", value:
"Multiple models of the Uniview IP Camera offer an undocumented UDP
service on port 7788 that allows a remote, unauthenticated attacker to
overflow an internal buffer and achieve code execution.

By using this buffer overflow, a remote attacker can start the telnetd
service. This service has a hardcoded default username and password.
Although it has a restrictive shell, this can be easily bypassed via
the built-in ECHO shell command.

This plugin only works with Tenable.ot.
Please visit https://www.tenable.com/products/tenable-ot for more information.");
  # https://www.uniview.com/About_Us/Security/Notice/202112/920471_140493_0.htm
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?0de2d11a");
  script_set_attribute(attribute:"see_also", value:"https://ssd-disclosure.com/ssd-advisory--uniview-preauth-rce/");
  script_set_attribute(attribute:"solution", value:
"Upgrade the device to the fixed firmware build for its release branch,
as listed in Uniview security notice USRC-202112-01.

The vendor also notes that exploitation requires reaching UDP port 7788
on the device. Ensure that port is not mapped to the Internet (WAN) by a
router or firewall, do not configure the device as a DMZ host, and do not
configure a full cone NAT.");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2021-45039");

  script_cwe_id(120);

  script_set_attribute(attribute:"vuln_publication_date", value:"2021/12/22");
  script_set_attribute(attribute:"patch_publication_date", value:"2021/12/22");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/10/02");

  script_set_attribute(attribute:"plugin_type", value:"remote");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:uniview:camera_firmware");
  script_set_attribute(attribute:"generated_plugin", value:"former");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Tenable.ot");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("tenable_ot_api_integration.nasl");
  script_require_keys("Tenable.ot/Uniview");

  exit(0);
}


include('tenable_ot_cve_funcs.inc');

get_kb_item_or_exit('Tenable.ot/Uniview');

var asset = tenable_ot::assets::get(vendor:'Uniview');

# Family match: the CPE product is model-less, uniview::model_compare accepts it for
# the whole Uniview camera subtree (recorders excluded). One entry per affected branch
# from USRC-202112-01, as branches are not mutually ordered. The CPE suffix is that
# branch, not a model, and only keeps the keys unique.
var vuln_cpes = {
    "cpe:/o:uniview:camera_firmware:anpr-b1101" :
        {"versionEndIncluding" : "ANPR-B1101.3.3.210712", "family" : "Uniview"},
    "cpe:/o:uniview:camera_firmware:cipc-b2301" :
        {"versionEndIncluding" : "CIPC-B2301.5.35.210705", "family" : "Uniview"},
    "cpe:/o:uniview:camera_firmware:cipc-b2302" :
        {"versionEndIncluding" : "CIPC-B2302.3.35.210928", "family" : "Uniview"},
    "cpe:/o:uniview:camera_firmware:dipc-b1209" :
        {"versionEndIncluding" : "DIPC-B1209.6.6.210701", "family" : "Uniview"},
    "cpe:/o:uniview:camera_firmware:dipc-b1211" :
        {"versionEndIncluding" : "DIPC-B1211.6.12.210922", "family" : "Uniview"},
    "cpe:/o:uniview:camera_firmware:dipc-b1213" :
        {"versionEndIncluding" : "DIPC-B1213.2.62.210930", "family" : "Uniview"},
    "cpe:/o:uniview:camera_firmware:dipc-b1216" :
        {"versionEndIncluding" : "DIPC-B1216.2.60.210922", "family" : "Uniview"},
    "cpe:/o:uniview:camera_firmware:dipc-b1221" :
        {"versionEndIncluding" : "DIPC-B1221.1.69.211103", "family" : "Uniview"},
    "cpe:/o:uniview:camera_firmware:dipc-b1222" :
        {"versionEndIncluding" : "DIPC-B1222.1.62.210729", "family" : "Uniview"},
    "cpe:/o:uniview:camera_firmware:dipc-b1223" :
        {"versionEndIncluding" : "DIPC-B1223.1.72.211029", "family" : "Uniview"},
    "cpe:/o:uniview:camera_firmware:dipc-b1225" :
        {"versionEndIncluding" : "DIPC-B1225.1.63.211021", "family" : "Uniview"},
    "cpe:/o:uniview:camera_firmware:gipc-b6102" :
        {"versionEndIncluding" : "GIPC-B6102.26.39.210705", "family" : "Uniview"},
    "cpe:/o:uniview:camera_firmware:gipc-b6103" :
        {"versionEndIncluding" : "GIPC-B6103.16.35.210705", "family" : "Uniview"},
    "cpe:/o:uniview:camera_firmware:gipc-b6106" :
        {"versionEndIncluding" : "GIPC-B6106.8.40.210705", "family" : "Uniview"},
    "cpe:/o:uniview:camera_firmware:gipc-b6110" :
        {"versionEndIncluding" : "GIPC-B6110.5.6.210701", "family" : "Uniview"},
    "cpe:/o:uniview:camera_firmware:gipc-b6202" :
        {"versionEndIncluding" : "GIPC-B6202.5.38.211015", "family" : "Uniview"},
    "cpe:/o:uniview:camera_firmware:gipc-b6203" :
        {"versionEndIncluding" : "GIPC-B6203.3.33.210924", "family" : "Uniview"},
    "cpe:/o:uniview:camera_firmware:hcmn-b2201" :
        {"versionEndIncluding" : "HCMN-B2201.6.7.210705", "family" : "Uniview"},
    "cpe:/o:uniview:camera_firmware:hcmn-r2103" :
        {"versionEndIncluding" : "HCMN-R2103.28.36.210705", "family" : "Uniview"},
    "cpe:/o:uniview:camera_firmware:hcmn-r2108" :
        {"versionEndIncluding" : "HCMN-R2108.13.35.210705", "family" : "Uniview"},
    "cpe:/o:uniview:camera_firmware:ipc_g6107" :
        {"versionEndIncluding" : "IPC_G6107-B0001P97D1806", "family" : "Uniview"},
    "cpe:/o:uniview:camera_firmware:ipc_q6303" :
        {"versionEndIncluding" : "IPC_Q6303-B0001P67D1907", "family" : "Uniview"},
    "cpe:/o:uniview:camera_firmware:qipc-b1203" :
        {"versionEndIncluding" : "QIPC-B1203.16.7.210708", "family" : "Uniview"},
    "cpe:/o:uniview:camera_firmware:qipc-b1208" :
        {"versionEndIncluding" : "QIPC-B1208.7.7.210705", "family" : "Uniview"},
    "cpe:/o:uniview:camera_firmware:qipc-b2201" :
        {"versionEndIncluding" : "QIPC-B2201.9.12.210827", "family" : "Uniview"},
    "cpe:/o:uniview:camera_firmware:qipc-b2202" :
        {"versionEndIncluding" : "QIPC-B2202.3.35.210928", "family" : "Uniview"},
    "cpe:/o:uniview:camera_firmware:qipc-b6301" :
        {"versionEndIncluding" : "QIPC-B6301.9.9.210828", "family" : "Uniview"},
    "cpe:/o:uniview:camera_firmware:qipc-b6302" :
        {"versionEndIncluding" : "QIPC-B6302.2.8.210907", "family" : "Uniview"},
    "cpe:/o:uniview:camera_firmware:qipc-b8701" :
        {"versionEndIncluding" : "QIPC-B8701.9.7.210705", "family" : "Uniview"},
    "cpe:/o:uniview:camera_firmware:qipc-b9101" :
        {"versionEndIncluding" : "QIPC-B9101.6.7.210705", "family" : "Uniview"},
    "cpe:/o:uniview:camera_firmware:qipc-r1201" :
        {"versionEndIncluding" : "QIPC-R1201.30.36.210705", "family" : "Uniview"},
    "cpe:/o:uniview:camera_firmware:qipc-r1206" :
        {"versionEndIncluding" : "QIPC-R1206.9.32.210705", "family" : "Uniview"},
    "cpe:/o:uniview:camera_firmware:qipc-r1207" :
        {"versionEndIncluding" : "QIPC-R1207.8.35.210705", "family" : "Uniview"},
    "cpe:/o:uniview:camera_firmware:qpts-b2209" :
        {"versionEndIncluding" : "QPTS-B2209.3.71.CLA002.210413", "family" : "Uniview"}
};

tenable_ot::cve::compare_and_report(asset:asset, cpes:vuln_cpes, severity:SECURITY_HOLE);