CVE-2026-25643

Exploit de RCE Ciega en Frigate NVR ≤ 0.16.3 CVE-2026-25643 PoC 📜 Descripción Este exploit en Python aprovecha una vulnerabilidad crítica de manipulación de configuración en las versiones de Frigate NVR hasta la 0.16.3 tanto en rutas autenticadas como no autenticadas. Al inyectar una transmisión...

QVIS NVR/DVR - Remote Code Execution

QVIS NVR DVR before 2021-12-13 is vulnerable to Remote Code Execution via Java deserialization. id: CVE-2021-41419 info: name: QVIS NVR/DVR - Remote Code Execution author: me9187 severity: critical description: | QVIS NVR DVR before 2021-12-13 is vulnerable to Remote Code Execution via Java...

tiandy-research

tiandy-research 本仓库包含我于 2020 年 8 月对 Tiandy 的 IPC/NVR 固件（这些设备也以 OMNY 品牌销售）的研究结果。这项“研究”并不详尽，但我确实找到了多种远程恢复管理员密码、启用 telnet 以及修改 root 密码的方法。 很难确切地说哪些版本受影响，因为我们只能下载到最近的版本。以下这些可下载版本均受影响： root@kitploit: DVRSV9.12.7.20200422 DVRSV11.7.4.20200721 NVSSV13.6.1.20200723 NVSSV22.1.0.20200722...

CVE-2025-1338

CVE-2025-1338 本仓库包含针对 CVE-2025-1338 的概念验证（PoC）利用脚本。 1.NUUO 摄像头简介 NUUO 摄像头是由中国台湾省 NUUO 公司生产的网络视频录像机（NVR），广泛应用于零售、交通、教育、政府和银行等多个领域。 2.漏洞简介 NUUO 摄像头 20250203 及更早版本存在注入漏洞，该漏洞源于 handleconfig.php 和 debuggingcenterutils .php 中参数 log 的命令注入。 • 首次收录时间：2025 年 2 月 16 日 • 受影响版本：version=20250203 •...

frigate

Frigate NVR™ - IPカメラ向けリアルタイム物体検出 English | 简体中文 AI物体検出機能を備えた、Home Assistant向けに設計された完全なローカルNVRです。OpenCVとTensorflowを使用して、IPカメラ向けにローカルでリアルタイムの物体検出を実行します。 GPUまたはAIアクセラレータの使用を強くお勧めします。AIアクセラレータは、ほんのわずかなオーバーヘッドで最高のCPUをも上回る性能を発揮します。Frigateがサポートする物体検出器をご覧ください。 カスタムコンポーネントによるHome Assistantとの緊密な統合...

cve-2020-15956

cve-2020-15956 ACTi NVR 2.3 Standard/Professional Server 与 ACTi NVR3 Standard/Professional Server 允许远程未认证攻击者实施拒绝服务攻击。要利用此漏洞，只需向媒体服务器发送至少 760 字节的畸形授权头负载，即可触发缓冲区溢出，导致 ActiveMediaServer.exe 应用程序终止。 受影响版本（可能还有其他版本）： ACTi NVR3 Standard Server V.3.0.12.42 ACTi NVR Professional V.2.3.04.07...

CVE-2019-9653

CVE-2019-9653 日付 開示: 2019年3月11日 最終更新: 2019年3月15日 概要 NUUO Inc. は、ビデオ中心の監視ソリューションを提供する企業です。さまざまな要件を持つ顧客向けに、多くのNVR（ネットワークビデオレコーダー）製品を展開しています。これらのNVRは、複数のカメラを管理できるLinux組み込み型のビデオ録画システムです。現在、世界中の多くの公共機関、企業、銀行、個人などで使用されています。...

Hikvision-City-Hunter

La herramienta definitiva de reconocimiento y explotación a nivel de ciudad para 2025 para cámaras IP Hikvision, DVRs y NVRs Salida en vivo de consola • DVRs/NVRs resaltados en púrpura • Cámaras en verde • Descarga automática de instantáneas • Filtrado de honeypots...

CVE-2026-66372

CVE-2026-66372 affects the Digital Watchdog VMAX DVR and NVR product lineups. The root cause is a predictable seed in the pseudo-random number generator (PRNG) , resulting in insufficiently random values that make web session tokens predictable and bound their entropy to the seed space. The CVSS ...

CVE-2026-66887

Digital Watchdog VMAX DVR and NVR devices are vulnerable due to missing authorization on state-changing CGI endpoints and the absence of session checks , allowing an attacker on the adjacent network to modify device state without authentication. CISA ICS-CERT rated this CRITICAL (CVSS 3.1: 9.6 / ...

CVE-2026-66887 Missing Authorization in Digital Watchdog VMAX DVR and NVR Product Lineups

The affected products are missing authorization on state-changing CGIs and session checks are not performed...

CVE-2026-68950 Use of Hard-coded Credentials in Digital Watchdog VMAX DVR and NVR Product Lineups

The affected products use hard-coded credentials, which could allow an attacker to run the ftpd service as root, providing remote root file access where FTP is reachable...

CVE-2026-68950

CVE-2026-68950 affects Digital Watchdog VMAX DVR and NVR product lineups. The root cause is hard-coded credentials , which allow an attacker to run the ftpd service as root , granting remote root file access where FTP is reachable. The vulnerability is rated HIGH severity (CVSS 3.1: 8.8, CVSS 4.0...

CVE-2026-68070

Digital Watchdog VMAX DVR and NVR product lineups are affected by a missing authentication flaw for a critical function, allowing an adjacent-network attacker—requiring no privileges—to execute code as root by passing received bytes directly to a system command (command injection). CISA rates it ...

CVE-2026-68070 Missing Authentication for Critical Function in Digital Watchdog VMAX DVR and NVR Product Lineups

The affected products are missing authentication for a critical function, which could allow an attacker to run as root and pass received bytes directly to a system command...

CVE-2026-66890 Use of Hard-coded Credentials in Digital Watchdog VMAX DVR and NVR Product Lineups

The affected products use hard-coded credentials, which could allow remote access to files with root privileges where FTP is reachable...

CVE-2026-66890

Digital Watchdog VMAX DVR and NVR devices are affected by a hard-coded credentials vulnerability that allows an attacker with adjacent-network access to gain remote file access with root privileges when the device's FTP service is reachable. The CISA-assigned CVSS 3.1 score is 9.6 (CRITICAL) , wi...

CVE-2026-68953

CVE-2026-68953 is a missing authentication for critical function vulnerability affecting the Digital Watchdog VMAX DVR and NVR product lineups. Unauthenticated attackers on an adjacent network can send crafted HTTP(S) requests to bypass authentication and disclose sensitive device information, in...

CVE-2026-68953 Missing Authentication for Critical Function in Digital Watchdog VMAX DVR and NVR Product Lineups

The affected products are vulnerable to an authentication bypass that allows unauthenticated remote attackers to disclose sensitive device information, including administrator credentials in plaintext, by sending crafted HTTPS requests...

CVE-2017-14263

HoneywellNVRvul CVE-2017-14263 xfuturesec Co., Ltd まず、ゲストユーザーのSessionIDを取得します。 SessionIDは任意のHTTPリクエストから見つけることができます。例： POST https://192.168.1.104/RPC2 HTTP/1.1 Accept: text/javascript, text/html, application/xml, text/xml X-Requested-With: XMLHttpRequest X-Request: JSON Content-Type:...