PT-2024-18972 · Kiloview · Kiloview Ndi

Published 2024-03-21 · Updated 2024-03-22 · CVE-2024-2161

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Kiloview NDI versions prior to 2.02.0227

Description The issue is related to the use of hard-coded credentials in Kiloview NDI, allowing un-authenticated users to bypass authentication. This affects models N3, N3-s, N4, N20, N30, N40.

Recommendations For versions prior to 2.02.0227, update the firmware to version 2.02.0227 to resolve the issue. As a temporary workaround, consider restricting access to the affected devices until the update can be applied.

Fix

Using Hardcoded Credentials

Weakness Enumeration

CWE-798

Related Identifiers

CVE-2024-2161

Affected Products

Kiloview Ndi

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2024-2161 · Security Note
• https://twitter.com/cracbot/status/1771321539213795819 · Twitter Post
• https://kiloview.com/en/support/download/1779 · Note
• https://kiloview.com/en/support/download/n3-for-ndi · Note
• https://kiloview.com/en/support/download/n40 · Note
• https://kiloview.com/en/support/download/n20-firmware-download · Note
• https://kiloview.com/en/support/download/n3-s-firmware-download · Note
• https://kiloview.com/en/support/download/n30-for-ndi · Note