CVE-2023-30467CWE-285

Improper Authorization Vulnerability in Milesight Network Video Recorder (NVR)

High · published April 28, 2023

CVSS v3.1
7.5
EPSS
1%
Percentile
64.8
In the wild
Unconfirmed
What it is

This vulnerability exists in Milesight 4K/H.265 Series NVR models (MS-Nxxxx-xxG, MS-Nxxxx-xxE, MS-Nxxxx-xxT, MS-Nxxxx-xxH and MS-Nxxxx-xxC), due to improper authorization at the Milesight NVR web-based management interface. A remote attacker could exploit this vulnerability by sending a specially crafted http requests on the targeted device.

Successful exploitation of this vulnerability could allow remote attacker to perform unauthorized activities on the targeted device.

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS v4.0
Not supplied
EPSS
0.01078 · 64.8th percentile
Weakness
CWE-285 · Improper Authorization
Published
2023-04-28T10:12Z
EPSS history
Timeline
  • 28 APR 10:12Z
    Improper Authorization Vulnerability in Milesight Network Video Recorder (NVR)
    cvelistv5