PT-2022-4503 · Isnex+1 · Isnex Hc-Ip9050Hd+2

Published 2022-08-29 · Updated 2022-11-14 · CVE-2022-37681

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:C

Name of the Vulnerable Software and Affected Versions Hitachi Kokusai Electric Newtork products versions prior to the fixed version ISnex HC-IP9100HD version 1.07 and below ISnex HC-IP9050HD version not specified

Description The issue is related to the /ptippage.cgi component of the network camera video surveillance software, which is associated with incorrect restriction of the path name to a directory with limited access. This can allow a remote attacker to gain full access to the device. The vulnerability can be exploited via a crafted GET request to the /ptippage.cgi endpoint, allowing directory traversal.

Recommendations For ISnex HC-IP9100HD version 1.07 and below: update to a version that contains a fix for the issue. For ISnex HC-IP9050HD: at the moment, there is no information about a newer version that contains a fix for this vulnerability. As a temporary workaround, consider restricting access to the /ptippage.cgi endpoint until a patch is available.

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

BDU:2022-05370

CVE-2022-37681

Affected Products

Hitachi Kokusai Electric Network Products

Isnex Hc-Ip9050Hd

Isnex Hc-Ip9100Hd

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2022-37681 · Security Note
• https://hitachi-kokusai.co.jp/global/en/products/info/vulnerable/hitachi-sec-2022-001/index.html · Vendor Advisory
• https://bdu.fstec.ru/vul/2022-05370 · Security Note
• https://osv.dev/vulnerability/CVE-2022-37681 · Vendor Advisory
• https://t.me/cibsecurity/49013 · Telegram Post
• https://t.me/cvenotify/35384 · Telegram Post
• https://vuldb.com/?id.207566 · Note
• https://gist.github.com/Nwqda/5efea18c9142c6a966d85c6be2c0c2b5 · Note