Lucene search

CERT-InCVE-2023-30467

HistoryApr 28, 2023 - 11:15 a.m.

CVE-2023-30467

2023-04-2811:15:09

CWE-285

CWE-863

CERT-In

web.nvd.nist.gov

milesight

nvr

vulnerability

authorization

cve-2023-30467

security

exploit

remote attacker

http requests

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

9.1

Confidence

High

EPSS

0.003

Percentile

68.9%

JSON

This vulnerability exists in Milesight 4K/H.265 Series NVR models (MS-Nxxxx-xxG, MS-Nxxxx-xxE, MS-Nxxxx-xxT, MS-Nxxxx-xxH and MS-Nxxxx-xxC), due to improper authorization at the Milesight NVR web-based management interface. A remote attacker could exploit this vulnerability by sending a specially crafted http requests on the targeted device.

Successful exploitation of this vulnerability could allow remote attacker to perform unauthorized activities on the targeted device.

Affected configurations

Nvd

Node

milesightms-n5008-uc_firmwareRange<73.9.0.18-r2

AND

milesightms-n5008-ucMatch-

Node

milesightms-n1008-unc_firmwareRange<73.9.0.18-r2

AND

milesightms-n1008-uncMatch-

Node

milesightms-n1008-uc_firmwareRange<73.9.0.18-r2

AND

milesightms-n1008-ucMatch-

Node

milesightms-n1004-uc_firmwareRange<73.9.0.18-r2

AND

milesightms-n1004-ucMatch-

Node

milesightms-n5016-e_firmwareRange<75.9.0.18-r2

AND

milesightms-n5016-eMatch-

Node

milesightms-n5008-e_firmwareRange<75.9.0.18-r2

AND

milesightms-n5008-eMatch-

Node

milesightms-n7016-uh_firmwareRange<71.9.0.18-r2

AND

milesightms-n7016-uhMatch-

Node

milesightms-n7032-uh_firmwareRange<71.9.0.18-r2

AND

milesightms-n7032-uhMatch-

Node

milesightms-n8064-uh_firmwareRange<71.9.0.18-r2

AND

milesightms-n8064-uhMatch-

Node

milesightms-n8032-uh_firmwareRange<71.9.0.18-r2

AND

milesightms-n8032-uhMatch-

Node

milesightms-n1004-upc_firmwareRange<73.9.0.18-r2

AND

milesightms-n1004-upcMatch-

Node

milesightms-n1008-upc_firmwareRange<73.9.0.18-r2

AND

milesightms-n1008-upcMatch-

Node

milesightms-n1008-unpc_firmwareRange<73.9.0.18-r2

AND

milesightms-n1008-unpcMatch-

Node

milesightms-n5008-upc_firmwareRange<73.9.0.18-r2

AND

milesightms-n5008-upcMatch-

Node

milesightms-n5016-pe_firmwareRange<75.9.0.18-r2

AND

milesightms-n5016-peMatch-

Node

milesightms-n5008-pe_firmwareRange<75.9.0.18-r2

AND

milesightms-n5008-peMatch-

Node

milesightms-n7016-uph_firmwareRange<71.9.0.18-r2

AND

milesightms-n7016-uphMatch-

Node

milesightms-n7032-uph_firmwareRange<71.9.0.18-r2

AND

milesightms-n7032-uphMatch-

Node

milesightms-n7048-uph_firmwareRange<71.9.0.18-r2

AND

milesightms-n7048-uphMatch-

Node

milesightms-nxxxx-xxg_firmwareRange<77.9.0.18-r2

milesightms-nxxxx-xxt_firmwareRange<72.9.0.18-r2

VendorProductVersionCPE
milesightms-n5008-uc_firmware*cpe:2.3:o:milesight:ms-n5008-uc_firmware:*:*:*:*:*:*:*:*
milesightms-n5008-uc-cpe:2.3:h:milesight:ms-n5008-uc:-:*:*:*:*:*:*:*
milesightms-n1008-unc_firmware*cpe:2.3:o:milesight:ms-n1008-unc_firmware:*:*:*:*:*:*:*:*
milesightms-n1008-unc-cpe:2.3:h:milesight:ms-n1008-unc:-:*:*:*:*:*:*:*
milesightms-n1008-uc_firmware*cpe:2.3:o:milesight:ms-n1008-uc_firmware:*:*:*:*:*:*:*:*
milesightms-n1008-uc-cpe:2.3:h:milesight:ms-n1008-uc:-:*:*:*:*:*:*:*
milesightms-n1004-uc_firmware*cpe:2.3:o:milesight:ms-n1004-uc_firmware:*:*:*:*:*:*:*:*
milesightms-n1004-uc-cpe:2.3:h:milesight:ms-n1004-uc:-:*:*:*:*:*:*:*
milesightms-n5016-e_firmware*cpe:2.3:o:milesight:ms-n5016-e_firmware:*:*:*:*:*:*:*:*
milesightms-n5016-e-cpe:2.3:h:milesight:ms-n5016-e:-:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
milesight	ms-n5008-uc_firmware	*	cpe:2.3:o:milesight:ms-n5008-uc_firmware::::::::
milesight	ms-n5008-uc	-	cpe:2.3:h:milesight:ms-n5008-uc:-:::::::*
milesight	ms-n1008-unc_firmware	*	cpe:2.3:o:milesight:ms-n1008-unc_firmware::::::::
milesight	ms-n1008-unc	-	cpe:2.3:h:milesight:ms-n1008-unc:-:::::::*
milesight	ms-n1008-uc_firmware	*	cpe:2.3:o:milesight:ms-n1008-uc_firmware::::::::
milesight	ms-n1008-uc	-	cpe:2.3:h:milesight:ms-n1008-uc:-:::::::*
milesight	ms-n1004-uc_firmware	*	cpe:2.3:o:milesight:ms-n1004-uc_firmware::::::::
milesight	ms-n1004-uc	-	cpe:2.3:h:milesight:ms-n1004-uc:-:::::::*
milesight	ms-n5016-e_firmware	*	cpe:2.3:o:milesight:ms-n5016-e_firmware::::::::
milesight	ms-n5016-e	-	cpe:2.3:h:milesight:ms-n5016-e:-:::::::*

Rows per page:

1-10 of 401

CNA Affected

[
  {
    "defaultStatus": "unaffected",
    "product": "NVR MS-Nxxxx-xxG",
    "vendor": "Milesight",
    "versions": [
      {
        "lessThan": "77.9.0.18-r2",
        "status": "affected",
        "version": "77.X",
        "versionType": "custom"
      }
    ]
  },
  {
    "defaultStatus": "unaffected",
    "product": "NVR MS-Nxxxx-xxE",
    "vendor": "Milesight",
    "versions": [
      {
        "lessThan": "75.9.0.18-r2",
        "status": "affected",
        "version": "75.X",
        "versionType": "custom"
      }
    ]
  },
  {
    "defaultStatus": "unaffected",
    "product": "NVR MS-Nxxxx-xxT",
    "vendor": "Milesight",
    "versions": [
      {
        "lessThan": "72.9.0.18-r2",
        "status": "affected",
        "version": "72.X",
        "versionType": "custom"
      }
    ]
  },
  {
    "defaultStatus": "unaffected",
    "product": "NVR MS-Nxxxx-xxH ",
    "vendor": "Milesight",
    "versions": [
      {
        "lessThan": "71.9.0.18-r2",
        "status": "affected",
        "version": "71.X",
        "versionType": "custom"
      }
    ]
  },
  {
    "defaultStatus": "unaffected",
    "product": "NVR MS-Nxxxx-xxC",
    "vendor": "Milesight",
    "versions": [
      {
        "lessThan": "73.9.0.18-r2",
        "status": "affected",
        "version": "73.X",
        "versionType": "custom"
      }
    ]
  }
]

References

www.cert-in.org.in/s2cMainServlet?pageid=PUBVLNOTES01&VLCODE=CIVN-2023-0121

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

9.1

Confidence

High

EPSS

0.003

Percentile

68.9%

JSON

Related for CVE-2023-30467