CVE-2017-14263

Summary of CVE-2017-14263 Affected product: Honeywell NVR devices (network video recorder). Vulnerability details: Remote attackers can create a user account in the admin group by abusing access to a guest account to obtain a session ID, then sending that session ID in a userManager.addUser reque...

CVE-2017-14262

On Samsung NVR devices, remote attackers can read the MD5 password hash of the 'admin' account via certain szUserName JSON data to cgi-bin/main-cgi, and login to the device with that hash in the szUserPasswd parameter...

CVE-2017-14263

Honeywell NVR devices allow remote attackers to create a user account in the admin group by leveraging access to a guest account to obtain a session ID, and then sending that session ID in a userManager.addUser request to the /RPC2 URI. The attacker can login to the device with that new user...

Uniview NVR - Password Disclosure

Uniview NVR remote passwords disclosure Author: B1t The Uniview NVR web application does not enforce authorizations on the main.cgi file when requesting json data. It says that you can do anything without authentication, however you must know the request structure. In addition, the users' passwor...

Uniview NVR - Password Disclosure

Uniview NVR - Password Disclosure Uniview NVR remote passwords disclosure Author: B1t The Uniview NVR web application does not enforce authorizations on the main.cgi file when requesting json data. It says that you can do anything without authentication, however you must know the request structur...

CMVISION CM-NVST-MP08 Command Injection Vulnerability

The ddnsserver.cgi script on the device's webserver that runs as root is vulnerable to remote command execution by an authenticated user, with the default password being "admin:admin". The address GET parameter is fed to the command line by the CGI script without sanitization for semicolons,...

Hikvision NVR Buffer Overflow Vulnerability (CNVD-2017-03883)

The Hikvision NVR DS-76xxNI-E1/2 and DS-77xxxNI-E4 are both hard disk recorders from Hikvision, a Chinese company. A buffer overflow vulnerability exists in the Hikvision NVRs. It allows an attacker to cause a denial of service service interruption via a crafted HTTP request i.e. SDK issue...

Hikvision NVR Buffer Overflow Vulnerability (CNVD-2017-03882)

The Hikvision NVR DS-76xxNI-E1/2 and DS-77xxxNI-E4 are both hard disk recorders from Hikvision, a Chinese company. A buffer overflow vulnerability exists in the Hikvision NVRs. It allows an attacker to cause a denial of service service interruption via a crafted HTTP request i.e. SDK issue...

Buffer overflow

Buffer overflow on Hikvision NVR DS-76xxNI-E1/2 and DS-77xxxNI-E4 devices before 3.4.0 allows remote authenticated users to cause a denial of service service interruption via a crafted HTTP request, aka the ISAPI issue...

CVE-2015-4407

Buffer overflow on Hikvision NVR DS-76xxNI-E1/2 and DS-77xxxNI-E4 devices before 3.4.0 allows remote authenticated users to cause a denial of service service interruption via a crafted HTTP request, aka the PSIA issue...

Buffer overflow

Buffer overflow on Hikvision NVR DS-76xxNI-E1/2 and DS-77xxxNI-E4 devices before 3.4.0 allows remote authenticated users to cause a denial of service service interruption via a crafted HTTP request, aka the PSIA issue...

Buffer overflow

Buffer overflow on Hikvision NVR DS-76xxNI-E1/2 and DS-77xxxNI-E4 devices before 3.4.0 allows remote authenticated users to cause a denial of service service interruption via a crafted HTTP request, aka the SDK issue...

CVE-2015-4408

Buffer overflow on Hikvision NVR DS-76xxNI-E1/2 and DS-77xxxNI-E4 devices before 3.4.0 allows remote authenticated users to cause a denial of service service interruption via a crafted HTTP request, aka the ISAPI issue...

CVE-2015-4409

Buffer overflow on Hikvision NVR DS-76xxNI-E1/2 and DS-77xxxNI-E4 devices before 3.4.0 allows remote authenticated users to cause a denial of service service interruption via a crafted HTTP request, aka the SDK issue...

CVE-2015-4407

Buffer overflow on Hikvision NVR DS-76xxNI-E1/2 and DS-77xxxNI-E4 devices before 3.4.0 allows remote authenticated users to cause a denial of service service interruption via a crafted HTTP request, aka the PSIA issue...

CVE-2015-4408

Buffer overflow on Hikvision NVR DS-76xxNI-E1/2 and DS-77xxxNI-E4 devices before 3.4.0 allows remote authenticated users to cause a denial of service service interruption via a crafted HTTP request, aka the ISAPI issue...

CVE-2015-4409

Buffer overflow on Hikvision NVR DS-76xxNI-E1/2 and DS-77xxxNI-E4 devices before 3.4.0 allows remote authenticated users to cause a denial of service service interruption via a crafted HTTP request, aka the SDK issue...

CVE-2015-4407

CVE-2015-4407 affects Hikvision NVR models DS-76xxNI-E1/2 and DS-77xxxNI-E4. A buffer overflow in handling PSIA-enabled HTTP requests allows remote authenticated users to trigger a denial of service (service interruption). The vulnerability exists in devices prior to version 3.4.0; upgrading to 3...

CVE-2015-4409

CVE-2015-4409 affects Hikvision NVR models DS-76xxNI-E1/2 and DS-77xxxNI-E4, with a buffer overflow in the HTTP/SDK handling that can be triggered by a crafted request. The issue allows remote authenticated users to cause a denial of service (service interruption). Affected versions are before 3....

CVE-2015-4408

The CVE-2015-4408 issue affects Hikvision NVR models DS-76xxNI-E1/2 and DS-77xxxNI-E4 prior to version 3.4.0. A buffer overflow in the ISAPI HTTP handling allows remote authenticated users to cause a denial of service (service interruption) by sending a crafted HTTP request. Impact is specificall...