1162 matches found
TBK DVR devices OS Command Injection Vulnerability (Apr 2024) - Active Check
TBK DVR devices are prone to an OS command injection vulnerability. SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only if description...
CVE-2023-6095
CVE-2023-6095 refers to a remote code execution vulnerability in Hanwha Vision NVR/DVR devices. The flaw allows an attacker to inject malicious HTTP headers into request packets to execute arbitrary code on the device; exploitation details and the specific vulnerable component are not fully enume...
CVE-2023-6095: Stack-based Buffer Overflow
Vladimir Kononovich, a Security Researcher has found a flaw that allows for a remote code execution on the DVR. An attacker could inject malicious HTTP headers into request packets to execute arbitrary code. The manufacturer has released patch firmware for the flaw, please refer to the...
CVE-2023-6096: Exposure of Resource to Wrong Sphere
Vladimir Kononovich, a Security Researcher has found a flaw that using a inappropriate encryption logic on the DVR. firmware encryption is broken and allows to decrypt. The manufacturer has released patch firmware for the flaw, please refer to the manufacturer's report for details and workarounds...
PT-2024-14881
Name of the Vulnerable Software and Affected Versions DVR affected versions not specified Description A flaw has been discovered that allows for remote code execution on the DVR. An attacker could inject malicious HTTP headers into request packets to execute arbitrary code. Recommendations At the...
PT-2024-14882 · Unknown · Dvr Firmware
Name of the Vulnerable Software and Affected Versions: DVR firmware affected versions not specified Description: A flaw has been discovered in the DVR firmware's encryption logic, which is inappropriate and allows for decryption. The issue was found by Vladimir Kononovich, a security researcher...
Hanwha Vision NVR and DVR security vulnerabilities
Hanwha Vision NVR and Hanwha Vision DVR are both products of Hanwha Vision, a South Korean company.Hanwha Vision NVR is a series of network video recorder devices.Hanwha Vision DVR is a series of digital video recorder devices. A security vulnerability exists in Hanwha Vision NVRs and DVRs that...
CVE-2024-3721
A vulnerability was found in TBK DVR-4104 and DVR-4216 up to 20240412 and classified as critical. This issue affects some unknown processing of the file /device.rsp?opt=sys&cmd=SOSTREAMAX. The manipulation of the argument mdb/mdc leads to os command injection. The attack may be initiated remotely...
CVE-2024-3721 TBK DVR-4104/DVR-4216 os command injection
A vulnerability was found in TBK DVR-4104 and DVR-4216 up to 20240412 and classified as critical. This issue affects some unknown processing of the file /device.rsp?opt=sys&cmd=SOSTREAMAX. The manipulation of the argument mdb/mdc leads to os command injection. The attack may be initiated remotely...
CVE-2024-3721 TBK DVR-4104/DVR-4216 os command injection
A vulnerability was found in TBK DVR-4104 and DVR-4216 up to 20240412 and classified as critical. This issue affects some unknown processing of the file /device.rsp?opt=sys&cmd=SOSTREAMAX. The manipulation of the argument mdb/mdc leads to os command injection. The attack may be initiated remotely...
CVE-2024-3721
CVE-2024-3721 is an OS command injection affecting TBK DVR-4104 and DVR-4216 (firmware up to 20240412). The flaw stems from unsanitized parameters mdb/mdc in HTTP requests to /device.rsp?opt=sys&cmd=S_O_S_T_R_E_A_MAX . Successful exploitation allows unauthenticated remote command execution and ha...
CVE-2024-3721
A vulnerability was found in TBK DVR-4104 and DVR-4216 up to 20240412 and classified as critical. This issue affects some unknown processing of the file /device.rsp?opt=sys&cmd=SOSTREAMAX . The manipulation of the argument mdb/mdc leads to os command injection. The attack may be initiated remotel...
CVE-2024-3721: Improper Neutralization of Special Elements used in an OS Command
A vulnerability was found in TBK DVR-4104 and DVR-4216 up to 20240412 and classified as critical. This issue affects some unknown processing of the file /device.rsp?opt=sys&cmd=SOSTREAMAX. The manipulation of the argument mdb/mdc leads to os command injection. The attack may be initiated remotely...
PT-2024-27378
Name of the Vulnerable Software and Affected Versions TBK DVR-4104 versions prior to 20240412 TBK DVR-4216 versions prior to 20240412 Description An OS command injection flaw exists due to insufficient validation of user-supplied input. A remote, unauthenticated attacker can execute arbitrary cod...
TBK DVR-4104, DVR-4216: Operating system command injection vulnerabilities
TBK DVR-4104 is a digital video recorder from TBK. An OS command injection vulnerability exists in TBK DVR-4104, DVR-4216 version 20240412 and earlier versions, which stems from the fact that incorrect operation of the parameter mdb/mdc can lead to OS command injection...
CVE-2024-21815
Insufficiently protected credentials CWE-522 for third party DVR integrations to the Command Centre Server are accessible to authenticated but unprivileged users. This issue affects: Gallagher Command Centre 9.00 prior to vEL9.00.1774 MR2, 8.90 prior to vEL8.90.1751 MR3, 8.80 prior to vEL8.80.152...
Command injection
Insufficiently protected credentials CWE-522 for third party DVR integrations to the Command Centre Server are accessible to authenticated but unprivileged users. This issue affects: Gallagher Command Centre 9.00 prior to vEL9.00.1774 MR2, 8.90 prior to vEL8.90.1751 MR3, 8.80 prior to vEL8.80.152...
CVE-2024-21815
Gallagher Command Centre (Gallagher) is affected by CVE-2024-21815 due to insufficiently protected credentials (CWE-522) for third‑party DVR integrations to the Command Centre Server, potentially exposing credentials to authenticated but unprivileged users. Affected versions include 8.60 and prio...
CVE-2024-21815: Insufficiently Protected Credentials
Insufficiently protected credentials CWE-522 for third party DVR integrations to the Command Centre Server are accessible to authenticated but unprivileged users. This issue affects: Gallagher Command Centre 9.00 prior to vEL9.00.1774 MR2, 8.90 prior to vEL8.90.1751 MR3, 8.80 prior to vEL8.80.152...