PT-2023-30706 · Ezviz+1 · Ezviz Cs-C3N+3

Joerngermany

·

Published

2023-11-28

·

Updated

2024-02-22

·

CVE-2023-48121

CVSS v3.1

5.3

Medium

VectorAV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Name of the Vulnerable Software and Affected Versions Ezviz CS-C6N-xxx versions prior to v5.3.x build 20230401 Ezviz CS-CV310-xxx versions prior to v5.3.x build 20230401 Ezviz CS-C6CN-xxx versions prior to v5.3.x build 20230401 Ezviz CS-C3N-xxx versions prior to v5.3.x build 20230401 Hikvision products (affected versions not specified)
Description An authentication bypass vulnerability in the Direct Connection Module or Hik-Connect Module allows remote attackers to obtain sensitive information or consume services by sending crafted messages to the affected devices.
Recommendations For Ezviz CS-C6N-xxx versions prior to v5.3.x build 20230401, update to v5.3.x build 20230401 or later. For Ezviz CS-CV310-xxx versions prior to v5.3.x build 20230401, update to v5.3.x build 20230401 or later. For Ezviz CS-C6CN-xxx versions prior to v5.3.x build 20230401, update to v5.3.x build 20230401 or later. For Ezviz CS-C3N-xxx versions prior to v5.3.x build 20230401, update to v5.3.x build 20230401 or later. For Hikvision products, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Authentication

Weakness Enumeration

CWE-287

Related Identifiers

CVE-2023-48121

Affected Products

Ezviz Cs-C3N
Ezviz Cs-C6Cn
Ezviz Cs-Cv310
Hikvision