PT-2021-19987 · Annke · Annke N48Pbb

Andrea Palanca · Published 2021-08-30 · Updated 2022-06-07 · CVE-2021-32941

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Annke N48PBB (Network Video Recorder) versions 3.4.106 build 200422 and prior

Description The issue is a stack-based buffer overflow that allows an unauthorized remote attacker to execute arbitrary code with the same privileges as the server user (root). This vulnerability affects Annke N48PBB Network Video Recorder products, which are used for storing and viewing video streams, as well as managing cameras. The vulnerability can be exploited to gain access to recorded videos, delete footage, modify configurations (such as motion detection signals), and disable certain cameras or the network video recorder to stop recording. It is estimated that more than 5 million clients worldwide are affected.

Recommendations For Annke N48PBB (Network Video Recorder) versions 3.4.106 build 200422 and prior, update the firmware to the latest version to patch the vulnerability. As a temporary workaround, consider restricting access to the device to minimize the risk of exploitation.

Fix

Memory Corruption

Stack Overflow

Weakness Enumeration

CWE-787

CWE-121

Related Identifiers

CVE-2021-32941

Affected Products

Annke N48Pbb

References · 6

• https://osv.dev/vulnerability/CVE-2021-32941 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-32941 · Security Note
• https://cisa.gov/uscert/ics/advisories/icsa-21-238-02 · Note
• https://t.me/cibsecurity/43189 · Telegram Post
• https://t.me/cvenotify/30594 · Telegram Post
• https://t.me/true_secator/2049 · Telegram Post