MV POWER CCTV DVR security vulnerability

MV POWER CCTV DVR is a series of CCTV cameras from MV POWER. A security vulnerability exists in MV POWER CCTV DVR TV-7104HE version 1.8.4 115215B9 and TV7108HE version. An attacker can exploit this vulnerability to execute arbitrary operating system commands as the root user...

CVE-2016-20016: Improper Neutralization of Special Elements used in an OS Command

MVPower CCTV DVR models, including TV-7104HE 1.8.4 115215B9 and TV7108HE, contain a web shell that is accessible via a /shell URI. A remote unauthenticated attacker can execute arbitrary operating system commands as root. This vulnerability has also been referred to as the "JAWS webserver RCE"...

CVE-2016-20016

MVPower CCTV DVR models, including TV-7104HE 1.8.4 115215B9 and TV7108HE, contain a web shell that is accessible via a /shell URI. A remote unauthenticated attacker can execute arbitrary operating system commands as root. This vulnerability has also been referred to as the "JAWS webserver RCE"...

Mirai Variant MooBot Botnet Exploiting D-Link Router Vulnerabilities

A variant of the Mirai botnet known as MooBot is co-opting vulnerable D-Link devices into an army of denial-of-service bots by taking advantage of multiple exploits. "If the devices are compromised, they will be fully controlled by attackers, who could utilize those devices to conduct further...

CVE-2022-35733

Missing authentication for critical function vulnerability in UNIMO Technology digital video recorders UDR-JA1004/JA1008/JA1016 firmware versions v1.0.20.13 and earlier, and UDR-JA1016 firmware versions v2.0.20.13 and earlier allows a remote unauthenticated attacker to execute an arbitrary OS...

CVE-2021-44954

In QVIS NVR DVR before 2021-12-13, an attacker can escalate privileges from a qvisdvr user to the root user by abusing a Sudo misconfiguration...

CVE-2021-41419

QVIS NVR DVR before 2021-12-13 is vulnerable to Remote Code Execution via Java deserialization...

CVE-2021-41419

QVIS NVR DVR before 2021-12-13 is vulnerable to Remote Code Execution via Java deserialization...

CVE-2021-44954

In QVIS NVR DVR before 2021-12-13, an attacker can escalate privileges from a qvisdvr user to the root user by abusing a Sudo misconfiguration...

Deserialization of untrusted data

QVIS NVR DVR before 2021-12-13 is vulnerable to Remote Code Execution via Java deserialization...

Design/Logic Flaw

In QVIS NVR DVR before 2021-12-13, an attacker can escalate privileges from a qvisdvr user to the root user by abusing a Sudo misconfiguration...

CVE-2021-44954

CVE-2021-44954 affects QVIS NVR DVR prior to 2021-12-13. A sudo misconfiguration allows local privilege escalation from the qvisdvr user to root. The base score is 7.8 (HIGH) with LOCAL attack vector and no user interaction required. The provided documents do not specify a patch/version for remed...

CVE-2021-44954

In QVIS NVR DVR before 2021-12-13, an attacker can escalate privileges from a qvisdvr user to the root user by abusing a Sudo misconfiguration...

CVE-2021-41419

CVE-2021-41419 affects QVIS NVR/DVR firmware prior to 2021-12-13. The vulnerability stems from Java deserialization and permits remote code execution, enabling an attacker to execute arbitrary code with the device’s privileges, potentially leading to full system compromise. The CVSS v3.1 score is...

CVE-2021-41419

QVIS NVR DVR before 2021-12-13 is vulnerable to Remote Code Execution via Java deserialization...

CVE-2021-41419: Deserialization of Untrusted Data

QVIS NVR DVR before 2021-12-13 is vulnerable to Remote Code Execution via Java deserialization...

PT-2022-12265

Name of the Vulnerable Software and Affected Versions QVIS NVR DVR versions prior to 2021-12-13 Description The issue allows an attacker to escalate privileges from a qvisdvr user to the root user by exploiting a Sudo misconfiguration. Recommendations For versions prior to 2021-12-13, update to a...

CVE-2021-44954: Undefined Security Weakness

In QVIS NVR DVR before 2021-12-13, an attacker can escalate privileges from a qvisdvr user to the root user by abusing a Sudo misconfiguration...

PT-2022-11395

Name of the Vulnerable Software and Affected Versions QVIS NVR DVR versions prior to 2021-12-13 Description The issue allows for Remote Code Execution via Java deserialization. Recommendations For versions prior to 2021-12-13, update to a version released after 2021-12-13 to resolve the issue...

CVE-2021-41506

Xiaongmai AHB7008T-MH-V2, AHB7804R-ELS, AHB7804R-MH-V2, AHB7808R-MS-V2, AHB7808R-MS, AHB7808T-MS-V2, AHB7804R-LMS, HI351850H10LS39 V4.02.R11.7601.Nat.Onvif.20170420, V4.02.R11.Nat.Onvif.20160422, V4.02.R11.7601.Nat.Onvif.20170424, V4.02.R11.Nat.Onvif.20170327, V4.02.R11.Nat.Onvif.20161205,...