CVE-2024-5631CWE-319

Longse NVR (Network Video Recorder) model NVR3608PGE2W, as well as products based on this device, are transmitting user's login and password to a remote…

Medium · published July 9, 2024

CVSS v4.0
6.0
EPSS
0%
Percentile
10.3
In the wild
Unconfirmed
What it is

Longse NVR (Network Video Recorder) model NVR3608PGE2W, as well as products based on this device, are transmitting user's login and password to a remote control service without using any encryption. This enables an on-path attacker to eavesdrop the credentials and subsequently obtain access to the video stream.

The credentials are being sent when a user decides to change his password in router's portal.

The record
Technical detail
CVSS v4.0
6.0 · MEDIUM
Vector
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
EPSS
0.00208 · 10.3th percentile
Weakness
CWE-319 · Cleartext Transmission of Sensitive Information
Published
2024-07-09T10:57Z
EPSS history
Timeline
  • 09 JUL 10:57Z
    Longse NVR (Network Video Recorder) model NVR3608PGE2W, as well as products based on this device, are transmitting user's login and password to a remote…
    cvelistv5