CVE-2018-11689

CVE-2018-11689 describes a cross-site scripting (XSS) vulnerability in the Web Viewer codebase used by Hanwha/DVR and Samsung Smart Viewer. The flaw is triggered via the data3 parameter in /cgi-bin/webviewer_login_page, affecting Hanwha DVR 2.17 and Samsung Web Viewer. CVSS metrics indicate netwo...

CVE-2014-9265

CVE-2014-9265: A stack-based buffer overflow in the BackupToAvi method of Samsung SmartViewer’s CNC_Ctrl ActiveX Control allows remote code execution. The root cause is improper validation of the input buffer size before copying into a fixed-size stack buffer. Exploitation typically requires user...

CVE-2015-8039

Samsung SmartViewer is affected by CVE-2015-8039 via untrusted pointer dereference in two components: the DVRSetupSave method of STWAxConfig and the SendCustomPacket method of STWAxConfigNVR. Connected advisories (ZDI-15-462, ZDI-15-463) describe remote code execution with attacker-supplied memor...

CVE-2015-8040

The CVE-2015-8040 issue affects Samsung SmartViewer’s CNC_Ctrl ActiveX control, specifically the rtsp_getdlsendtime method. The root cause is improper validation of a user-supplied index value, enabling a remote attacker to execute arbitrary code. Exploitation would occur when a target user visit...