PT-2022-4366 · Unknown · Unimo Digital Video Recorders

Masaki Kubo + 2 · Published 2022-08-22 · Updated 2025-09-16 · CVE-2022-35733

Positive Technologies (AI Summary)

CVSS v3.1

10

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions UNIMO digital video recorders versions v1.0.20.13 and earlier UNIMO digital video recorders versions v2.0.20.13 and earlier

Description The issue is related to the absence of authentication for a critical function in the firmware of UNIMO digital video recorders. This allows a remote attacker to execute arbitrary OS commands by sending a specially crafted request to the affected device's web interface.

Recommendations For versions v1.0.20.13 and earlier, update to a version that includes authentication for critical functions. For versions v2.0.20.13 and earlier, update to a version that includes authentication for critical functions. As a temporary workaround, consider restricting access to the web interface of the affected devices until a patch is available.

Fix

Missing Authentication

Weakness Enumeration

CWE-306

Related Identifiers

BDU:2022-05226

CVE-2022-35733

Affected Products

Unimo Digital Video Recorders

References · 12

• http://unimo.co.jp/table_notice/index.php?act=1&resid=1643590226-637355 · Vendor Advisory
• https://safe-surf.ru/upload/VULN/VULN-20220822.29.pdf · Security Note
• https://osv.dev/vulnerability/CVE-2022-35733 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-35733 · Security Note
• https://bdu.fstec.ru/vul/2022-05226 · Security Note
• https://jvn.jp/en/vu/JVNVU90821877/index.html · Note
• https://t.me/aptreports/11253 · Telegram Post
• https://t.me/aptreports/22022 · Telegram Post
• http://unimo.co.jp/table_notice/index.php?act=1&resid=1643590226-637355 · Note
• https://t.me/cibsecurity/48570 · Telegram Post
• https://twitter.com/fletch_ai/status/1803714824389734817 · Twitter Post
• https://t.me/aptreports/22058 · Telegram Post