PT-2018-10750 · Hanwha+1 · Hanwha Web Viewer+1

Yavuz Atlas · Published 2018-06-14 · Updated 2022-04-24 · CVE-2018-11689

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Hanwha Web Viewer version 2.17 Samsung Web Viewer (affected versions not specified)

Description The issue affects the Web Viewer for Hanwha DVR and Smart Viewer in Samsung Web Viewer for Samsung DVR, allowing for XSS attacks. The vulnerability can be exploited via the /cgi-bin/webviewer login page API endpoint, specifically through the data3 parameter.

Recommendations For Hanwha Web Viewer version 2.17, avoid using the data3 parameter in the /cgi-bin/webviewer login page API endpoint until the issue is resolved. For Samsung Web Viewer, restrict access to the /cgi-bin/webviewer login page API endpoint to minimize the risk of exploitation, as the affected versions are not specified. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2018-11689

Affected Products

Hanwha Web Viewer

Samsung Web Viewer

References · 7

• 🔥 http://seclists.org/fulldisclosure/2018/Jun/40 · Exploit
• 🔥 https://seclists.org/bugtraq/2018/Jun/40 · Exploit
• 🔥 https://drive.google.com/file/d/1aWbvdrx1KRkUv4ikkm530a2N5qrxCLmr/view?usp=sharing · Exploit
• 🔥 http://securityfocus.com/archive/1/542083/100/0/threaded · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2018-11689 · Security Note
• https://osv.dev/vulnerability/CVE-2018-11689 · Vendor Advisory
• https://vulmon.com/vulnerabilitydetails?qid=CVE-2018-11689 · Note