CVE-2023-5747CWE-345CWE-347

Command injection via wave install file

High · published November 13, 2023

CVSS v3.1
7.2
EPSS
1%
Percentile
46.1
In the wild
Unconfirmed
What it is

Bashis, a Security Researcher at IPVM has found a flaw that allows for a remote code execution during the installation of Wave on the camera device. The Wave server application in camera device was vulnerable to command injection allowing an attacker to run arbitrary code. HanwhaVision has released patched firmware for the highlighted flaw. Please refer to the hanwhavision security report for more information and solution."

The record
Technical detail
CVSS v3.1
7.2 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00563 · 46.1th percentile
Weaknesses
CWE-345 · Insufficient Verification of Data Authenticity; CWE-347 · Improper Verification of Cryptographic Signature
Published
2023-11-13T07:48Z
EPSS history
Timeline
  • 13 NOV 07:48Z
    Command injection via wave install file
    cvelistv5