PT-2023-26266 · Unknown · Xiamen Four Letter Video Surveillance Management System

Guiqizsq · Published 2023-07-21 · Updated 2024-05-17 · CVE-2023-3805

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Xiamen Four Letter Video Surveillance Management System versions up to 20230712

Description A critical issue has been found in the library UserInfoAction.class of the component Login, affecting some unknown processing. This leads to improper authorization. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

Recommendations For Xiamen Four Letter Video Surveillance Management System versions up to 20230712, consider disabling the Login component or restricting access to the UserInfoAction.class library until a patch is available. As a temporary workaround, restrict the use of the Login functionality to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Improper Authorization

Weakness Enumeration

CWE-285

Related Identifiers

CVE-2023-3805

Affected Products

Xiamen Four Letter Video Surveillance Management System

References · 8

• 🔥 https://github.com/GUIqizsq/cve/blob/main/login.md · Exploit
• https://osv.dev/vulnerability/CVE-2023-3805 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-3805 · Security Note
• https://t.me/cvenotify/54814 · Telegram Post
• https://vuldb.com/?id.235073 · Note
• https://vuldb.com/?ctiid.235073 · Note
• https://t.me/cibsecurity/67076 · Telegram Post
• https://t.me/cvenotify/54842 · Telegram Post