Skip to content
CVE PROGRAM SOURCE RECORD7.5 High

CVE-2023-30467

Improper Authorization Vulnerability in Milesight Network Video Recorder (NVR)

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
CERT-In

Description

This vulnerability exists in Milesight 4K/H.265 Series NVR models (MS-Nxxxx-xxG, MS-Nxxxx-xxE, MS-Nxxxx-xxT, MS-Nxxxx-xxH and MS-Nxxxx-xxC), due to improper authorization at the Milesight NVR web-based management interface. A remote attacker could exploit this vulnerability by sending a specially crafted http requests on the targeted device. Successful exploitation of this vulnerability could allow remote attacker to perform unauthorized activities on the targeted device.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Milesight NVR MS-Nxxxx-xxG

Default version status: unaffected

  • 77.X to < 77.9.0.18-r2affected

Milesight NVR MS-Nxxxx-xxE

Default version status: unaffected

  • 75.X to < 75.9.0.18-r2affected

Milesight NVR MS-Nxxxx-xxT

Default version status: unaffected

  • 72.X to < 72.9.0.18-r2affected

Milesight NVR MS-Nxxxx-xxH

Default version status: unaffected

  • 71.X to < 71.9.0.18-r2affected

Milesight NVR MS-Nxxxx-xxC

Default version status: unaffected

  • 73.X to < 73.9.0.18-r2affected

References