PT-2022-27390 · Xiongmai · Xiongmai Nvr

Published 2022-12-01 · Updated 2022-12-06 · CVE-2022-45045

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Xiongmai NVR devices, including MBD6304T V4.02.R11.00000117.10001.131900.00000 and NBD6808T-PL V4.02.R11.C7431119.12001.130000.00000

Description The issue allows authenticated users to execute arbitrary commands as root. A remote and authenticated attacker can connect to port 34567 and execute arbitrary operating system commands via a crafted JSON file during an upgrade request. This has been exploited in the wild since approximately 2019. The attacker may use default admin credentials. Xiongmai has applied patches since at least 2021 to prevent the execution of telnetd via this mechanism.

Recommendations For MBD6304T V4.02.R11.00000117.10001.131900.00000, apply the patch released by Xiongmai to prevent the execution of arbitrary commands. For NBD6808T-PL V4.02.R11.C7431119.12001.130000.00000, apply the patch released by Xiongmai to prevent the execution of arbitrary commands. As a temporary workaround, consider restricting access to port 34567 to minimize the risk of exploitation. Avoid using default admin credentials, such as admin:tlJwpbo6, to prevent unauthorized access.

Exploit

Fix

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

CVE-2022-45045

Affected Products

Xiongmai Nvr

References · 5

• 🔥 https://vulncheck.com/blog/xiongmai-iot-exploitation · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2022-45045 · Security Note
• https://osv.dev/vulnerability/CVE-2022-45045 · Vendor Advisory
• https://t.me/cvenotify/38847 · Telegram Post
• https://t.me/cibsecurity/53750 · Telegram Post