Lucene search

[email protected]NVD:CVE-2023-30466

HistoryApr 28, 2023 - 11:15 a.m.

CVE-2023-30466

2023-04-2811:15:08

CWE-640

[email protected]

web.nvd.nist.gov

vulnerability

milesight nvr

remote attacker

password reset

account takeover

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

9.4

Confidence

High

EPSS

0.003

Percentile

68.9%

JSON

This vulnerability exists in Milesight 4K/H.265 Series NVR models (MS-Nxxxx-xxG, MS-Nxxxx-xxE, MS-Nxxxx-xxT, MS-Nxxxx-xxH and MS-Nxxxx-xxC), due to a weak password reset mechanism at the Milesight NVR web-based management interface. A remote attacker could exploit this vulnerability by sending a specially crafted http requests on the targeted device.

Successful exploitation of this vulnerability could allow remote attacker to account takeover on the targeted device.

Affected configurations

Nvd

Node

milesightms-n5008-uc_firmwareRange<73.9.0.18-r2

AND

milesightms-n5008-ucMatch-

Node

milesightms-n1008-unc_firmwareRange<73.9.0.18-r2

AND

milesightms-n1008-uncMatch-

Node

milesightms-n1008-uc_firmwareRange<73.9.0.18-r2

AND

milesightms-n1008-ucMatch-

Node

milesightms-n1004-uc_firmwareRange<73.9.0.18-r2

AND

milesightms-n1004-ucMatch-

Node

milesightms-n5016-e_firmwareRange<75.9.0.18-r2

AND

milesightms-n5016-eMatch-

Node

milesightms-n5008-e_firmwareRange<75.9.0.18-r2

AND

milesightms-n5008-eMatch-

Node

milesightms-n7016-uh_firmwareRange<71.9.0.18-r2

AND

milesightms-n7016-uhMatch-

Node

milesightms-n7032-uh_firmwareRange<71.9.0.18-r2

AND

milesightms-n7032-uhMatch-

Node

milesightms-n8064-uhMatch-

AND

milesightms-n8064-uh_firmwareRange<71.9.0.18-r2

Node

milesightms-n8032-uhMatch-

AND

milesightms-n8032-uh_firmwareRange<71.9.0.18-r2

Node

milesightms-n1004-upcMatch-

AND

milesightms-n1004-upc_firmwareRange<73.9.0.18-r2

Node

milesightms-n1008-upcMatch-

AND

milesightms-n1008-upc_firmwareRange<73.9.0.18-r2

Node

milesightms-n1008-unpcMatch-

AND

milesightms-n1008-unpc_firmwareRange<73.9.0.18-r2

Node

milesightms-n5008-upcMatch-

AND

milesightms-n5008-upc_firmwareRange<73.9.0.18-r2

Node

milesightms-n5016-peMatch-

AND

milesightms-n5016-pe_firmwareRange<75.9.0.18-r2

Node

milesightms-n5008-peMatch-

AND

milesightms-n5008-pe_firmwareRange<75.9.0.18-r2

Node

milesightms-n7016-uphMatch-

AND

milesightms-n7016-uph_firmwareRange<71.9.0.18-r2

Node

milesightms-n7032-uphMatch-

AND

milesightms-n7032-uph_firmwareRange<71.9.0.18-r2

Node

milesightms-n7048-uph_firmwareRange<71.9.0.18-r2

AND

milesightms-n7048-uphMatch-

Node

milesightms-nxxxx-xxg_firmwareRange<77.9.0.18-r2

milesightms-nxxxx-xxt_firmwareRange<72.9.0.18-r2

VendorProductVersionCPE
milesightms-n5008-uc_firmware*cpe:2.3:o:milesight:ms-n5008-uc_firmware:*:*:*:*:*:*:*:*
milesightms-n5008-uc-cpe:2.3:h:milesight:ms-n5008-uc:-:*:*:*:*:*:*:*
milesightms-n1008-unc_firmware*cpe:2.3:o:milesight:ms-n1008-unc_firmware:*:*:*:*:*:*:*:*
milesightms-n1008-unc-cpe:2.3:h:milesight:ms-n1008-unc:-:*:*:*:*:*:*:*
milesightms-n1008-uc_firmware*cpe:2.3:o:milesight:ms-n1008-uc_firmware:*:*:*:*:*:*:*:*
milesightms-n1008-uc-cpe:2.3:h:milesight:ms-n1008-uc:-:*:*:*:*:*:*:*
milesightms-n1004-uc_firmware*cpe:2.3:o:milesight:ms-n1004-uc_firmware:*:*:*:*:*:*:*:*
milesightms-n1004-uc-cpe:2.3:h:milesight:ms-n1004-uc:-:*:*:*:*:*:*:*
milesightms-n5016-e_firmware*cpe:2.3:o:milesight:ms-n5016-e_firmware:*:*:*:*:*:*:*:*
milesightms-n5016-e-cpe:2.3:h:milesight:ms-n5016-e:-:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
milesight	ms-n5008-uc_firmware	*	cpe:2.3:o:milesight:ms-n5008-uc_firmware::::::::
milesight	ms-n5008-uc	-	cpe:2.3:h:milesight:ms-n5008-uc:-:::::::*
milesight	ms-n1008-unc_firmware	*	cpe:2.3:o:milesight:ms-n1008-unc_firmware::::::::
milesight	ms-n1008-unc	-	cpe:2.3:h:milesight:ms-n1008-unc:-:::::::*
milesight	ms-n1008-uc_firmware	*	cpe:2.3:o:milesight:ms-n1008-uc_firmware::::::::
milesight	ms-n1008-uc	-	cpe:2.3:h:milesight:ms-n1008-uc:-:::::::*
milesight	ms-n1004-uc_firmware	*	cpe:2.3:o:milesight:ms-n1004-uc_firmware::::::::
milesight	ms-n1004-uc	-	cpe:2.3:h:milesight:ms-n1004-uc:-:::::::*
milesight	ms-n5016-e_firmware	*	cpe:2.3:o:milesight:ms-n5016-e_firmware::::::::
milesight	ms-n5016-e	-	cpe:2.3:h:milesight:ms-n5016-e:-:::::::*

Rows per page:

1-10 of 401

References

www.cert-in.org.in/s2cMainServlet?pageid=PUBVLNOTES01&VLCODE=CIVN-2023-0121

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

9.4

Confidence

High

EPSS

0.003

Percentile

68.9%

JSON

Related for NVD:CVE-2023-30466

cve1 prion1 cvelist1