Description (CNA)
This vulnerability exists in Milesight 4K/H.265 Series NVR models (MS-Nxxxx-xxG, MS-Nxxxx-xxE, MS-Nxxxx-xxT, MS-Nxxxx-xxH and MS-Nxxxx-xxC), due to a weak password reset mechanism at the Milesight NVR web-based management interface. A remote attacker could exploit this vulnerability by sending a specially crafted http requests on the targeted device. Successful exploitation of this vulnerability could allow remote attacker to account takeover on the targeted device.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| Milesight / NVR MS-Nxxxx-xxG | affected 77.X before 77.9.0.18-r2 |
| Milesight / NVR MS-Nxxxx-xxE | affected 75.X before 75.9.0.18-r2 |
| Milesight / NVR MS-Nxxxx-xxT | affected 72.X before 72.9.0.18-r2 |
| Milesight / NVR MS-Nxxxx-xxH | affected 71.X before 71.9.0.18-r2 |
| Milesight / NVR MS-Nxxxx-xxC | affected 73.X before 73.9.0.18-r2 |
CWE
CWE-640
References
ADP enrichment
No English description supplied.
No English description supplied.
No references supplied.