PT-2024-1439 · Unknown · Systemk Nvr

Published 2024-01-25 · Updated 2024-01-31 · CVE-2023-7227

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions SystemK NVR versions 2.3.5SK.30084998 and prior

Description The issue is related to a command injection vulnerability in the dynamic domain name system (DDNS) settings. This vulnerability could allow an attacker to execute arbitrary commands with root privileges. The vulnerability is associated with the lack of data cleaning measures at the management level, which can be exploited by a remote attacker.

Recommendations For versions 2.3.5SK.30084998 and prior, consider disabling the DDNS settings as a temporary workaround until a patch is available. Restrict access to the DDNS configuration to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Command Injection

Weakness Enumeration

CWE-77

Related Identifiers

BDU:2024-00923

CVE-2023-7227

Affected Products

Systemk Nvr

References · 7

• https://bdu.fstec.ru/vul/2024-00923 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2023-7227 · Security Note
• https://osv.dev/vulnerability/CVE-2023-7227 · Vendor Advisory
• https://safe-surf.ru/upload/VULN-new/VULN.2024-01-26.1.pdf · Security Note
• https://cisa.gov/news-events/ics-advisories/icsa-24-025-02 · Note
• https://vuldb.com/ru/?id.252058 · Note
• https://twitter.com/CVEnew/status/1750589465611870416 · Twitter Post