{"resultsPerPage":35,"startIndex":0,"totalResults":35,"format":"NVD_CVE","version":"2.0","timestamp":"2026-09-05T21:50:02.427","vulnerabilities":[{"cve":{"id":"CVE-2017-11510","sourceIdentifier":"vulnreport@tenable.com","published":"2018-03-28T17:29:00.273","lastModified":"2026-06-17T01:01:55.170","vulnStatus":"Modified","cveTags":[],"descriptions":[{"lang":"en","value":"An information leak exists in Wanscam's HW0021 network camera that allows an unauthenticated remote attacker to recover the administrator username and password via an ONVIF GetSnapshotUri request."},{"lang":"es","value":"Existe un filtrado de información en la cámara de red HW0021 de Wanscam que permite que un atacante remoto no autenticado recupere el nombre de usuario y contraseña del administrador mediante una petición ONVIF GetSnapshotUri."}],"affected":[{"source":"vulnreport@tenable.com","affectedData":[{"vendor":"Wanscam","product":"Wanscam HW0021","versions":[{"version":"11.6.5.1.1-20161213","status":"affected"}]}]}],"metrics":{"cvssMetricV30":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.0","vectorString":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":9.8,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":5.9}],"cvssMetricV2":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:P/I:N/A:N","baseScore":5.0,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"NONE","availabilityImpact":"NONE"},"baseSeverity":"MEDIUM","exploitabilityScore":10.0,"impactScore":2.9,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}]},"weaknesses":[{"source":"vulnreport@tenable.com","type":"Secondary","description":[{"lang":"en","value":"CWE-200"}]},{"source":"nvd@nist.gov","type":"Primary","description":[{"lang":"en","value":"CWE-522"}]}],"configurations":[{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:wanscam:hw0021_firmware:11.6.5.1.1-20161213:*:*:*:*:*:*:*","matchCriteriaId":"0969C2DE-C3F6-4572-B316-6838F78951E2"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:wanscam:hw0021:-:*:*:*:*:*:*:*","matchCriteriaId":"CAD623C0-2A52-4B2A-BC2C-90776AF2A619"}]}]}],"references":[{"url":"https://www.tenable.com/security/research/tra-2017-33","source":"vulnreport@tenable.com","tags":["Exploit","Third Party Advisory"]},{"url":"https://www.tenable.com/security/research/tra-2017-33","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Exploit","Third Party Advisory"]}]}},{"cve":{"id":"CVE-2018-14770","sourceIdentifier":"cve@mitre.org","published":"2018-09-05T21:29:00.780","lastModified":"2026-06-17T01:41:34.860","vulnStatus":"Modified","cveTags":[],"descriptions":[{"lang":"en","value":"VIVOTEK FD8177 devices before XXXXXX-VVTK-xx06a allow remote attackers to execute arbitrary code (issue 1 of 2) via the ONVIF interface, (/onvif/device_service)."},{"lang":"es","value":"Los dispositivos VIVOTEK FD8177 en versiones anteriores a la XXXXXX-VVTK-xx06a permiten a los atacantes remotos ejecutar código arbitrario (problema 1 de 2) mediante la interfaz ONVIF (/onvif/device_service)."}],"affected":[{"source":"cve@mitre.org","affectedData":[{"vendor":"n/a","product":"n/a","versions":[{"version":"n/a","status":"affected"}]}]}],"metrics":{"cvssMetricV30":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.0","vectorString":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":8.8,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":5.9}],"cvssMetricV2":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:S/C:C/I:C/A:C","baseScore":9.0,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"SINGLE","confidentialityImpact":"COMPLETE","integrityImpact":"COMPLETE","availabilityImpact":"COMPLETE"},"baseSeverity":"HIGH","exploitabilityScore":8.0,"impactScore":10.0,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}]},"weaknesses":[{"source":"nvd@nist.gov","type":"Primary","description":[{"lang":"en","value":"NVD-CWE-noinfo"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:h:vivotek:camera:-:*:*:*:*:*:*:*","matchCriteriaId":"C70F3D07-A12A-48F8-B5B9-FD25F19701F9"}]}]}],"references":[{"url":"http://download.vivotek.com/downloadfile/support/cyber-security/vvtk-sa-2018-003-v1.pdf","source":"cve@mitre.org","tags":["Mitigation","Vendor Advisory"]},{"url":"https://www.vivotek.com/website/support/cybersecurity/","source":"cve@mitre.org","tags":["Third Party Advisory"]},{"url":"http://download.vivotek.com/downloadfile/support/cyber-security/vvtk-sa-2018-003-v1.pdf","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Mitigation","Vendor Advisory"]},{"url":"https://www.vivotek.com/website/support/cybersecurity/","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory"]}]}},{"cve":{"id":"CVE-2018-13111","sourceIdentifier":"cve@mitre.org","published":"2018-09-21T17:29:03.623","lastModified":"2026-06-17T01:38:52.317","vulnStatus":"Modified","cveTags":[],"descriptions":[{"lang":"en","value":"There exists a partial Denial of Service vulnerability in Wanscam HW0021 IP Cameras. An attacker could craft a malicious POST request to crash the ONVIF service on such a device."},{"lang":"es","value":"Existe una vulnerabilidad de denegación de servicio (DoS) parcial en las cámaras IP Wanscam HW0021. Un atacante podría crear una petición POST maliciosa para provocar el cierre inesperado del servicio ONVIF en dicho dispositivo."}],"affected":[{"source":"cve@mitre.org","affectedData":[{"vendor":"n/a","product":"n/a","versions":[{"version":"n/a","status":"affected"}]}]}],"metrics":{"cvssMetricV30":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.0","vectorString":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","baseScore":5.9,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":2.2,"impactScore":3.6}],"cvssMetricV2":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:M/Au:N/C:N/I:N/A:P","baseScore":4.3,"accessVector":"NETWORK","accessComplexity":"MEDIUM","authentication":"NONE","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"PARTIAL"},"baseSeverity":"MEDIUM","exploitabilityScore":8.6,"impactScore":2.9,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}]},"weaknesses":[{"source":"nvd@nist.gov","type":"Primary","description":[{"lang":"en","value":"CWE-20"}]}],"configurations":[{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:wanscam:hw0021_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"20E63184-5872-4945-9F9B-86A8144D2A01"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:wanscam:hw0021:-:*:*:*:*:*:*:*","matchCriteriaId":"CAD623C0-2A52-4B2A-BC2C-90776AF2A619"}]}]}],"references":[{"url":"https://hackinganarchy.wordpress.com/2018/09/20/cve-2018-13111/","source":"cve@mitre.org","tags":["Technical Description","Third Party Advisory"]},{"url":"https://hackinganarchy.wordpress.com/2018/09/20/cve-2018-13111/","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Technical Description","Third Party Advisory"]}]}},{"cve":{"id":"CVE-2018-19078","sourceIdentifier":"cve@mitre.org","published":"2018-11-07T18:29:05.853","lastModified":"2026-06-17T01:48:44.937","vulnStatus":"Modified","cveTags":[],"descriptions":[{"lang":"en","value":"An issue was discovered on Foscam Opticam i5 devices with System Firmware 1.5.2.11 and Application Firmware 2.21.1.128. The response to an ONVIF media GetStreamUri request contains the administrator username and password."},{"lang":"es","value":"Se ha descubierto un problema en dispositivos Foscam Opticam i5 con firmware del sistema 1.5.2.11 y firmware de aplicación 2.21.1.128. La respuesta a una petición ONVIF media GetStreamUri contiene el nombre de usuario y la contraseña del administrador."}],"affected":[{"source":"cve@mitre.org","affectedData":[{"vendor":"n/a","product":"n/a","versions":[{"version":"n/a","status":"affected"}]}]}],"metrics":{"cvssMetricV30":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.0","vectorString":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":9.8,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":5.9}],"cvssMetricV2":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:P/I:N/A:N","baseScore":5.0,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"NONE","availabilityImpact":"NONE"},"baseSeverity":"MEDIUM","exploitabilityScore":10.0,"impactScore":2.9,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}]},"weaknesses":[{"source":"nvd@nist.gov","type":"Primary","description":[{"lang":"en","value":"CWE-522"}]}],"configurations":[{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:opticam:i5_application_firmware:2.21.1.128:*:*:*:*:*:*:*","matchCriteriaId":"42E72BBD-5418-4C2C-B8EB-997224A0CA01"},{"vulnerable":true,"criteria":"cpe:2.3:o:opticam:i5_system_firmware:1.5.2.11:*:*:*:*:*:*:*","matchCriteriaId":"B9E1C7BD-97E3-41F9-BC4D-9C7320C471EE"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:opticam:i5:-:*:*:*:*:*:*:*","matchCriteriaId":"670C0300-3A68-4AC1-B659-7727FF92D8E6"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:foscam:c2_application_firmware:2.72.1.32:*:*:*:*:*:*:*","matchCriteriaId":"05CCF2DD-D69B-4518-B20A-376C98E2D02E"},{"vulnerable":true,"criteria":"cpe:2.3:o:foscam:c2_system_firmware:1.11.1.8:*:*:*:*:*:*:*","matchCriteriaId":"28AD15E7-51C8-4B2D-BCEB-8EF2AA0B61A5"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:foscam:c2:-:*:*:*:*:*:*:*","matchCriteriaId":"107D84D0-9D16-4930-A312-38B7586B4B4F"}]}]}],"references":[{"url":"https://sintonen.fi/advisories/foscam-ip-camera-multiple-vulnerabilities.txt","source":"cve@mitre.org","tags":["Exploit","Third Party Advisory"]},{"url":"https://sintonen.fi/advisories/foscam-ip-camera-multiple-vulnerabilities.txt","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Exploit","Third Party Advisory"]}]}},{"cve":{"id":"CVE-2018-19079","sourceIdentifier":"cve@mitre.org","published":"2018-11-07T18:29:06.353","lastModified":"2026-06-17T01:48:45.067","vulnStatus":"Modified","cveTags":[],"descriptions":[{"lang":"en","value":"An issue was discovered on Foscam Opticam i5 devices with System Firmware 1.5.2.11 and Application Firmware 2.21.1.128. The ONVIF devicemgmt SystemReboot method allows unauthenticated reboot."},{"lang":"es","value":"Se ha descubierto un problema en dispositivos Foscam Opticam i5 con firmware del sistema 1.5.2.11 y firmware de aplicación 2.21.1.128. El método ONVIF devicemgmt SystemReboot permite el reinicio no autenticado."}],"affected":[{"source":"cve@mitre.org","affectedData":[{"vendor":"n/a","product":"n/a","versions":[{"version":"n/a","status":"affected"}]}]}],"metrics":{"cvssMetricV30":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.0","vectorString":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":3.6}],"cvssMetricV2":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:N/I:N/A:C","baseScore":7.8,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"COMPLETE"},"baseSeverity":"HIGH","exploitabilityScore":10.0,"impactScore":6.9,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}]},"weaknesses":[{"source":"nvd@nist.gov","type":"Primary","description":[{"lang":"en","value":"CWE-306"},{"lang":"en","value":"CWE-862"}]}],"configurations":[{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:opticam:i5_application_firmware:2.21.1.128:*:*:*:*:*:*:*","matchCriteriaId":"42E72BBD-5418-4C2C-B8EB-997224A0CA01"},{"vulnerable":true,"criteria":"cpe:2.3:o:opticam:i5_system_firmware:1.5.2.11:*:*:*:*:*:*:*","matchCriteriaId":"B9E1C7BD-97E3-41F9-BC4D-9C7320C471EE"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:opticam:i5:-:*:*:*:*:*:*:*","matchCriteriaId":"670C0300-3A68-4AC1-B659-7727FF92D8E6"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:foscam:c2_application_firmware:2.72.1.32:*:*:*:*:*:*:*","matchCriteriaId":"05CCF2DD-D69B-4518-B20A-376C98E2D02E"},{"vulnerable":true,"criteria":"cpe:2.3:o:foscam:c2_system_firmware:1.11.1.8:*:*:*:*:*:*:*","matchCriteriaId":"28AD15E7-51C8-4B2D-BCEB-8EF2AA0B61A5"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:foscam:c2:-:*:*:*:*:*:*:*","matchCriteriaId":"107D84D0-9D16-4930-A312-38B7586B4B4F"}]}]}],"references":[{"url":"https://sintonen.fi/advisories/foscam-ip-camera-multiple-vulnerabilities.txt","source":"cve@mitre.org","tags":["Exploit","Third Party Advisory"]},{"url":"https://sintonen.fi/advisories/foscam-ip-camera-multiple-vulnerabilities.txt","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Exploit","Third Party Advisory"]}]}},{"cve":{"id":"CVE-2018-19080","sourceIdentifier":"cve@mitre.org","published":"2018-11-07T18:29:06.807","lastModified":"2026-06-17T01:48:45.190","vulnStatus":"Modified","cveTags":[],"descriptions":[{"lang":"en","value":"An issue was discovered on Foscam Opticam i5 devices with System Firmware 1.5.2.11 and Application Firmware 2.21.1.128. The ONVIF devicemgmt SetHostname method allows unauthenticated persistent XSS."},{"lang":"es","value":"Se ha descubierto un problema en dispositivos Foscam Opticam i5 con firmware del sistema 1.5.2.11 y firmware de aplicación 2.21.1.128. El método ONVIF devicemgmt SetHostname permite Cross-Site Scripting (XSS) persistente no autenticado."}],"affected":[{"source":"cve@mitre.org","affectedData":[{"vendor":"n/a","product":"n/a","versions":[{"version":"n/a","status":"affected"}]}]}],"metrics":{"cvssMetricV30":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.0","vectorString":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","baseScore":6.1,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":2.7}],"cvssMetricV2":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:M/Au:N/C:N/I:P/A:N","baseScore":4.3,"accessVector":"NETWORK","accessComplexity":"MEDIUM","authentication":"NONE","confidentialityImpact":"NONE","integrityImpact":"PARTIAL","availabilityImpact":"NONE"},"baseSeverity":"MEDIUM","exploitabilityScore":8.6,"impactScore":2.9,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":true}]},"weaknesses":[{"source":"nvd@nist.gov","type":"Primary","description":[{"lang":"en","value":"CWE-79"}]}],"configurations":[{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:opticam:i5_application_firmware:2.21.1.128:*:*:*:*:*:*:*","matchCriteriaId":"42E72BBD-5418-4C2C-B8EB-997224A0CA01"},{"vulnerable":true,"criteria":"cpe:2.3:o:opticam:i5_system_firmware:1.5.2.11:*:*:*:*:*:*:*","matchCriteriaId":"B9E1C7BD-97E3-41F9-BC4D-9C7320C471EE"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:opticam:i5:-:*:*:*:*:*:*:*","matchCriteriaId":"670C0300-3A68-4AC1-B659-7727FF92D8E6"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:foscam:c2_application_firmware:2.72.1.32:*:*:*:*:*:*:*","matchCriteriaId":"05CCF2DD-D69B-4518-B20A-376C98E2D02E"},{"vulnerable":true,"criteria":"cpe:2.3:o:foscam:c2_system_firmware:1.11.1.8:*:*:*:*:*:*:*","matchCriteriaId":"28AD15E7-51C8-4B2D-BCEB-8EF2AA0B61A5"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:foscam:c2:-:*:*:*:*:*:*:*","matchCriteriaId":"107D84D0-9D16-4930-A312-38B7586B4B4F"}]}]}],"references":[{"url":"https://sintonen.fi/advisories/foscam-ip-camera-multiple-vulnerabilities.txt","source":"cve@mitre.org","tags":["Exploit","Third Party Advisory"]},{"url":"https://sintonen.fi/advisories/foscam-ip-camera-multiple-vulnerabilities.txt","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Exploit","Third Party Advisory"]}]}},{"cve":{"id":"CVE-2018-19081","sourceIdentifier":"cve@mitre.org","published":"2018-11-07T18:29:07.337","lastModified":"2026-06-17T01:48:45.317","vulnStatus":"Modified","cveTags":[],"descriptions":[{"lang":"en","value":"An issue was discovered on Foscam Opticam i5 devices with System Firmware 1.5.2.11 and Application Firmware 2.21.1.128. The ONVIF devicemgmt SetDNS method allows remote attackers to execute arbitrary OS commands via the IPv4Address field."},{"lang":"es","value":"Se ha descubierto un problema en dispositivos Foscam Opticam i5 con firmware del sistema 1.5.2.11 y firmware de aplicación 2.21.1.128. El método ONVIF devicemgmt SetDNS permite que atacantes remotos ejecuten comandos arbitrarios del sistema operativo mediante el campo IPv4Address."}],"affected":[{"source":"cve@mitre.org","affectedData":[{"vendor":"n/a","product":"n/a","versions":[{"version":"n/a","status":"affected"}]}]}],"metrics":{"cvssMetricV30":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.0","vectorString":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":9.8,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":5.9}],"cvssMetricV2":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:C/I:C/A:C","baseScore":10.0,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"COMPLETE","integrityImpact":"COMPLETE","availabilityImpact":"COMPLETE"},"baseSeverity":"HIGH","exploitabilityScore":10.0,"impactScore":10.0,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}]},"weaknesses":[{"source":"nvd@nist.gov","type":"Primary","description":[{"lang":"en","value":"CWE-78"}]}],"configurations":[{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:opticam:i5_application_firmware:2.21.1.128:*:*:*:*:*:*:*","matchCriteriaId":"42E72BBD-5418-4C2C-B8EB-997224A0CA01"},{"vulnerable":true,"criteria":"cpe:2.3:o:opticam:i5_system_firmware:1.5.2.11:*:*:*:*:*:*:*","matchCriteriaId":"B9E1C7BD-97E3-41F9-BC4D-9C7320C471EE"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:opticam:i5:-:*:*:*:*:*:*:*","matchCriteriaId":"670C0300-3A68-4AC1-B659-7727FF92D8E6"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:foscam:c2_application_firmware:2.72.1.32:*:*:*:*:*:*:*","matchCriteriaId":"05CCF2DD-D69B-4518-B20A-376C98E2D02E"},{"vulnerable":true,"criteria":"cpe:2.3:o:foscam:c2_system_firmware:1.11.1.8:*:*:*:*:*:*:*","matchCriteriaId":"28AD15E7-51C8-4B2D-BCEB-8EF2AA0B61A5"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:foscam:c2:-:*:*:*:*:*:*:*","matchCriteriaId":"107D84D0-9D16-4930-A312-38B7586B4B4F"}]}]}],"references":[{"url":"https://sintonen.fi/advisories/foscam-ip-camera-multiple-vulnerabilities.txt","source":"cve@mitre.org","tags":["Exploit","Third Party Advisory"]},{"url":"https://sintonen.fi/advisories/foscam-ip-camera-multiple-vulnerabilities.txt","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Exploit","Third Party Advisory"]}]}},{"cve":{"id":"CVE-2018-19082","sourceIdentifier":"cve@mitre.org","published":"2018-11-07T18:29:07.727","lastModified":"2026-06-17T01:48:45.443","vulnStatus":"Modified","cveTags":[],"descriptions":[{"lang":"en","value":"An issue was discovered on Foscam Opticam i5 devices with System Firmware 1.5.2.11 and Application Firmware 2.21.1.128. The ONVIF devicemgmt SetDNS method allows remote attackers to conduct stack-based buffer overflow attacks via the IPv4Address field."},{"lang":"es","value":"Se ha descubierto un problema en dispositivos Foscam Opticam i5 con firmware del sistema 1.5.2.11 y firmware de aplicación 2.21.1.128. El método ONVIF devicemgmt SetDNS permite que atacantes remotos lleven a cabo ataques de desbordamiento de búfer basado en pila mediante el campo IPv4Address."}],"affected":[{"source":"cve@mitre.org","affectedData":[{"vendor":"n/a","product":"n/a","versions":[{"version":"n/a","status":"affected"}]}]}],"metrics":{"cvssMetricV30":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.0","vectorString":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":9.8,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":5.9}],"cvssMetricV2":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:P/I:P/A:P","baseScore":7.5,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"PARTIAL"},"baseSeverity":"HIGH","exploitabilityScore":10.0,"impactScore":6.4,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}]},"weaknesses":[{"source":"nvd@nist.gov","type":"Primary","description":[{"lang":"en","value":"CWE-787"}]}],"configurations":[{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:opticam:i5_application_firmware:2.21.1.128:*:*:*:*:*:*:*","matchCriteriaId":"42E72BBD-5418-4C2C-B8EB-997224A0CA01"},{"vulnerable":true,"criteria":"cpe:2.3:o:opticam:i5_system_firmware:1.5.2.11:*:*:*:*:*:*:*","matchCriteriaId":"B9E1C7BD-97E3-41F9-BC4D-9C7320C471EE"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:opticam:i5:-:*:*:*:*:*:*:*","matchCriteriaId":"670C0300-3A68-4AC1-B659-7727FF92D8E6"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:foscam:c2_application_firmware:2.72.1.32:*:*:*:*:*:*:*","matchCriteriaId":"05CCF2DD-D69B-4518-B20A-376C98E2D02E"},{"vulnerable":true,"criteria":"cpe:2.3:o:foscam:c2_system_firmware:1.11.1.8:*:*:*:*:*:*:*","matchCriteriaId":"28AD15E7-51C8-4B2D-BCEB-8EF2AA0B61A5"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:foscam:c2:-:*:*:*:*:*:*:*","matchCriteriaId":"107D84D0-9D16-4930-A312-38B7586B4B4F"}]}]}],"references":[{"url":"https://sintonen.fi/advisories/foscam-ip-camera-multiple-vulnerabilities.txt","source":"cve@mitre.org","tags":["Exploit","Third Party Advisory"]},{"url":"https://sintonen.fi/advisories/foscam-ip-camera-multiple-vulnerabilities.txt","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Exploit","Third Party Advisory"]}]}},{"cve":{"id":"CVE-2018-20050","sourceIdentifier":"cve@mitre.org","published":"2018-12-10T22:29:00.237","lastModified":"2026-06-17T01:52:12.997","vulnStatus":"Modified","cveTags":[],"descriptions":[{"lang":"en","value":"Mishandling of an empty string on the Jooan JA-Q1H Wi-Fi camera with firmware 21.0.0.91 allows remote attackers to cause a denial of service (crash and reboot) via the ONVIF GetStreamUri method and GetVideoEncoderConfigurationOptions method."},{"lang":"es","value":"La gestión incorrecta de una cadena vacía en la cámara Wi-Fi Jooan JA-Q1H con firmware en versiones 21.0.0.91 permite que los atacantes remotos provoquen una denegación de servicio (cierre inesperado y reinicio) mediante los métodos ONVIF GetStreamUri y GetVideoEncoderConfigurationOptions."}],"affected":[{"source":"cve@mitre.org","affectedData":[{"vendor":"n/a","product":"n/a","versions":[{"version":"n/a","status":"affected"}]}]}],"metrics":{"cvssMetricV30":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.0","vectorString":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":3.6}],"cvssMetricV2":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:N/I:N/A:C","baseScore":7.8,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"COMPLETE"},"baseSeverity":"HIGH","exploitabilityScore":10.0,"impactScore":6.9,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}]},"weaknesses":[{"source":"nvd@nist.gov","type":"Primary","description":[{"lang":"en","value":"NVD-CWE-noinfo"}]}],"configurations":[{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qacctv:jooan_ja-q1h_wi-fi_camera_firmware:21.0.0.91:*:*:*:*:*:*:*","matchCriteriaId":"682EBEDB-67F2-4AB8-9C84-452E4FFA2849"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qacctv:jooan_ja-q1h_wi-fi_camera:-:*:*:*:*:*:*:*","matchCriteriaId":"32F6874D-41B4-49A3-8F38-120EB55EFA27"}]}]}],"references":[{"url":"https://github.com/iamweifan/jooan/blob/master/es_poc.py","source":"cve@mitre.org","tags":["Exploit","Third Party Advisory"]},{"url":"https://github.com/iamweifan/jooan/blob/master/es_poc.py","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Exploit","Third Party Advisory"]}]}},{"cve":{"id":"CVE-2018-20051","sourceIdentifier":"cve@mitre.org","published":"2018-12-10T22:29:00.297","lastModified":"2026-06-17T01:52:13.123","vulnStatus":"Modified","cveTags":[],"descriptions":[{"lang":"en","value":"Mishandling of '>' on the Jooan JA-Q1H Wi-Fi camera with firmware 21.0.0.91 allows remote attackers to cause a denial of service (crash and reboot) via certain ONVIF methods such as CreateUsers, SetImagingSettings, GetStreamUri, and so on."},{"lang":"es","value":"La gestión incorrecta de \">\" en la cámara Wi-Fi Jooan JA-Q1H con firmware en versiones 21.0.0.91 permite que los atacantes remotos provoquen una denegación de servicio (cierre inesperado y reinicio) mediante ciertos métodos ONVIF como CreateUsers, SetImagingSettings o GetStreamUri."}],"affected":[{"source":"cve@mitre.org","affectedData":[{"vendor":"n/a","product":"n/a","versions":[{"version":"n/a","status":"affected"}]}]}],"metrics":{"cvssMetricV30":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.0","vectorString":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":3.6}],"cvssMetricV2":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:N/I:N/A:C","baseScore":7.8,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"COMPLETE"},"baseSeverity":"HIGH","exploitabilityScore":10.0,"impactScore":6.9,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}]},"weaknesses":[{"source":"nvd@nist.gov","type":"Primary","description":[{"lang":"en","value":"CWE-20"}]}],"configurations":[{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:qacctv:jooan_ja-q1h_wi-fi_camera_firmware:21.0.0.91:*:*:*:*:*:*:*","matchCriteriaId":"682EBEDB-67F2-4AB8-9C84-452E4FFA2849"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:qacctv:jooan_ja-q1h_wi-fi_camera:-:*:*:*:*:*:*:*","matchCriteriaId":"32F6874D-41B4-49A3-8F38-120EB55EFA27"}]}]}],"references":[{"url":"https://github.com/iamweifan/jooan/blob/master/ss_poc.py","source":"cve@mitre.org","tags":["Third Party Advisory"]},{"url":"https://github.com/iamweifan/jooan/blob/master/ss_poc.py","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory"]}]}},{"cve":{"id":"CVE-2017-8227","sourceIdentifier":"cve@mitre.org","published":"2019-07-03T20:15:10.510","lastModified":"2026-06-17T01:26:00.550","vulnStatus":"Modified","cveTags":[],"descriptions":[{"lang":"en","value":"Amcrest IPM-721S V2.420.AC00.16.R.20160909 devices have a timeout policy to wait for 5 minutes in case 30 incorrect password attempts are detected using the Web and HTTP API interface provided by the device. However, if the same brute force attempt is performed using the ONVIF specification (which is supported by the same binary) then there is no account lockout or timeout executed. This can allow an attacker to circumvent the account protection mechanism and brute force the credentials. If the firmware version V2.420.AC00.16.R 9/9/2016 is dissected using binwalk tool, one obtains a _user-x.squashfs.img.extracted archive which contains the filesystem set up on the device that many of the binaries in the /usr folder. The binary \"sonia\" is the one that has the vulnerable function that performs the credential check in the binary for the ONVIF specification. If one opens this binary in IDA-pro one will notice that this follows a ARM little endian format. The function at address 00671618 in IDA pro is parses the WSSE security token header. The sub_ 603D8 then performs the authentication check and if it is incorrect passes to the function sub_59F4C which prints the value \"Sender not authorized.\""},{"lang":"es","value":"Los dispositivos Amcrest IPM-721S V2.420.AC00.16.R.20160909 tienen una política de tiempo de espera para esperar 5 minutos en caso de que se detecten 30 intentos de contraseña incorrectos mediante la interfaz web y API de HTTP proporcionada por el dispositivo. Sin embargo, si se realiza el mismo intento de fuerza bruta utilizando la especificación ONVIF (que es compatible con el mismo binario), entonces no se ejecuta el bloqueo de la cuenta o el tiempo de espera. Esto puede permitir a un atacante eludir el mecanismo de protección de la cuenta y forzar las credenciales. Si la versión del firmware V2.420.AC00.16.R 9/9/2016 se diseca con la herramienta binwalk, se obtiene un archivo _user-x.squashfs.img.extracted que contiene el sistema de archivos configurado en el dispositivo que muchos de los binarios en la carpeta / usr. El \"sonia\" binario es el que tiene la función vulnerable que realiza la verificación de credenciales en el binario para la especificación ONVIF. Si uno abre este binario en IDA-pro, notará que sigue un formato ARM little endian. La función en la dirección 00671618 en IDA pro es analizar el encabezado del token de seguridad WSSE. El sub_ 603D8 luego realiza la verificación de autorización y si es incorrecto pasa a la función sub_59F4C que imprime el valor \"Remitente no autorizado\"."}],"affected":[{"source":"cve@mitre.org","affectedData":[{"vendor":"n/a","product":"n/a","versions":[{"version":"n/a","status":"affected"}]}]}],"metrics":{"cvssMetricV30":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.0","vectorString":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":9.8,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":5.9}],"cvssMetricV2":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:P/I:N/A:N","baseScore":5.0,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"NONE","availabilityImpact":"NONE"},"baseSeverity":"MEDIUM","exploitabilityScore":10.0,"impactScore":2.9,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}]},"weaknesses":[{"source":"nvd@nist.gov","type":"Primary","description":[{"lang":"en","value":"CWE-254"}]}],"configurations":[{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:amcrest:ipm-721s_firmware:*:*:*:*:*:*:*:*","versionEndIncluding":"2.420.ac00.16.r.20160909","matchCriteriaId":"2EC72AB3-67BC-4187-8918-8030B045F383"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:amcrest:ipm-721s:-:*:*:*:*:*:*:*","matchCriteriaId":"A8A354BD-B8FC-45D1-B8B2-5A44334CF2F8"}]}]}],"references":[{"url":"http://packetstormsecurity.com/files/153224/Amcrest-IPM-721S-Credential-Disclosure-Privilege-Escalation.html","source":"cve@mitre.org","tags":["Third Party Advisory","VDB Entry"]},{"url":"https://github.com/ethanhunnt/IoT_vulnerabilities/blob/master/Amcrest_sec_issues.pdf","source":"cve@mitre.org","tags":["Exploit","Third Party Advisory"]},{"url":"https://seclists.org/bugtraq/2019/Jun/8","source":"cve@mitre.org","tags":["Mailing List","Third Party Advisory"]},{"url":"http://packetstormsecurity.com/files/153224/Amcrest-IPM-721S-Credential-Disclosure-Privilege-Escalation.html","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory","VDB Entry"]},{"url":"https://github.com/ethanhunnt/IoT_vulnerabilities/blob/master/Amcrest_sec_issues.pdf","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Exploit","Third Party Advisory"]},{"url":"https://seclists.org/bugtraq/2019/Jun/8","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Mailing List","Third Party Advisory"]}]}},{"cve":{"id":"CVE-2020-24051","sourceIdentifier":"cve@mitre.org","published":"2020-08-21T15:15:12.773","lastModified":"2026-06-17T03:05:11.640","vulnStatus":"Modified","cveTags":[],"descriptions":[{"lang":"en","value":"The Moog EXO Series EXVF5C-2 and EXVP7C2-3 units support the ONVIF interoperability IP-based physical security protocol, which requires authentication for some of its operations. It was found that the authentication check for those ONVIF operations can be bypassed. An attacker can abuse this issue to execute privileged operations without authentication, for instance, to create a new Administrator user."},{"lang":"es","value":"Las unidades EXVF5C-2 y EXVP7C2-3 de la Serie Moog EXO, admiten el protocolo de seguridad física basado en IP de interoperabilidad ONVIF, que requiere autenticación para algunas de sus operaciones. Se encontró que la comprobación de autenticación para esas operaciones ONVIF  puede ser omitida. Un atacante puede abusar de este problema para ejecutar operaciones privilegiadas sin autenticación, por ejemplo, para crear un nuevo usuario Administrador."}],"affected":[{"source":"cve@mitre.org","affectedData":[{"vendor":"n/a","product":"n/a","versions":[{"version":"n/a","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":9.8,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":5.9}],"cvssMetricV2":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:C/I:C/A:C","baseScore":10.0,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"COMPLETE","integrityImpact":"COMPLETE","availabilityImpact":"COMPLETE"},"baseSeverity":"HIGH","exploitabilityScore":10.0,"impactScore":10.0,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}]},"weaknesses":[{"source":"nvd@nist.gov","type":"Primary","description":[{"lang":"en","value":"CWE-306"}]}],"configurations":[{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:moog:exvf5c-2_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"BF20FE0F-EDB8-4BA4-A3B3-D141F2B01541"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:moog:exvf5c-2:-:*:*:*:*:*:*:*","matchCriteriaId":"69235D77-74E9-4D65-BB46-83BE55DDCCD8"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:moog:exvp7c2-3_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"D6F1521A-7795-438F-9EBD-8C866A856FAA"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:moog:exvp7c2-3:-:*:*:*:*:*:*:*","matchCriteriaId":"5DDBEF0A-717F-4564-A05D-17164EA6D6AA"}]}]}],"references":[{"url":"https://ioac.tv/3hy1xu6","source":"cve@mitre.org","tags":["Exploit","Third Party Advisory"]},{"url":"https://ioactive.com/moog-exo-series-multiple-vulnerabilities/","source":"cve@mitre.org","tags":["Third Party Advisory"]},{"url":"https://ioac.tv/3hy1xu6","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Exploit","Third Party Advisory"]},{"url":"https://ioactive.com/moog-exo-series-multiple-vulnerabilities/","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory"]}]}},{"cve":{"id":"CVE-2021-27392","sourceIdentifier":"productcert@siemens.com","published":"2021-04-22T21:15:10.363","lastModified":"2026-06-17T03:44:46.507","vulnStatus":"Modified","cveTags":[],"descriptions":[{"lang":"en","value":"A vulnerability has been identified in Siveillance Video Open Network Bridge (2020 R3), Siveillance Video Open Network Bridge (2020 R2), Siveillance Video Open Network Bridge (2020 R1), Siveillance Video Open Network Bridge (2019 R3), Siveillance Video Open Network Bridge (2019 R2), Siveillance Video Open Network Bridge (2019 R1), Siveillance Video Open Network Bridge (2018 R3), Siveillance Video Open Network Bridge (2018 R2). Affected Open Network Bridges store user credentials for the authentication between ONVIF clients and ONVIF server using a hard-coded key. The encrypted credentials can be retrieved via the MIP SDK. This could allow an authenticated remote attacker to retrieve and decrypt all credentials stored on the ONVIF server."},{"lang":"es","value":"Se ha identificado una vulnerabilidad en Siveillance Video Open Network Bridge (2020 R3), Siveillance Video Open Network Bridge (2020 R2), Siveillance Video Open Network Bridge (2020 R1), Siveillance Video Open Network Bridge (2019 R3), Siveillance Video Open Network Bridge (2019 R2), Siveillance Video Open Network Bridge (2019 R1), Siveillance Video Open Network Bridge (2018 R3), Siveillance Video Open Network Bridge (2018 R2).&#xa0;Los puentes de red abiertos afectados almacenan las credenciales de usuario para la autenticación entre los clientes ONVIF y el servidor ONVIF usando una clave embebida.&#xa0;Las credenciales cifradas pueden ser recuperadas por medio del MIP SDK.&#xa0;Esto podría permitir a un atacante remoto autenticado recuperar y descifrar todas las credenciales almacenadas en el servidor ONVIF"}],"affected":[{"source":"productcert@siemens.com","affectedData":[{"vendor":"Siemens","product":"Siveillance Video Open Network Bridge","versions":[{"version":"2020 R3","status":"affected"}]},{"vendor":"Siemens","product":"Siveillance Video Open Network Bridge","versions":[{"version":"2020 R2","status":"affected"}]},{"vendor":"Siemens","product":"Siveillance Video Open Network Bridge","versions":[{"version":"2020 R1","status":"affected"}]},{"vendor":"Siemens","product":"Siveillance Video Open Network Bridge","versions":[{"version":"2019 R3","status":"affected"}]},{"vendor":"Siemens","product":"Siveillance Video Open Network Bridge","versions":[{"version":"2019 R2","status":"affected"}]},{"vendor":"Siemens","product":"Siveillance Video Open Network Bridge","versions":[{"version":"2019 R1","status":"affected"}]},{"vendor":"Siemens","product":"Siveillance Video Open Network Bridge","versions":[{"version":"2018 R3","status":"affected"}]},{"vendor":"Siemens","product":"Siveillance Video Open Network Bridge","versions":[{"version":"2018 R2","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":8.8,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":5.9}],"cvssMetricV2":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:S/C:P/I:N/A:N","baseScore":4.0,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"SINGLE","confidentialityImpact":"PARTIAL","integrityImpact":"NONE","availabilityImpact":"NONE"},"baseSeverity":"MEDIUM","exploitabilityScore":8.0,"impactScore":2.9,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}]},"weaknesses":[{"source":"productcert@siemens.com","type":"Secondary","description":[{"lang":"en","value":"CWE-321"}]},{"source":"nvd@nist.gov","type":"Primary","description":[{"lang":"en","value":"CWE-798"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:siemens:siveillance_video_open_network_bridge:2018:r2:*:*:*:*:*:*","matchCriteriaId":"AC2636FC-7417-44A5-871C-EAABC66C3938"},{"vulnerable":true,"criteria":"cpe:2.3:a:siemens:siveillance_video_open_network_bridge:2018:r3:*:*:*:*:*:*","matchCriteriaId":"49CB17B2-6591-41B4-8A21-A75E91B6191C"},{"vulnerable":true,"criteria":"cpe:2.3:a:siemens:siveillance_video_open_network_bridge:2019:r1:*:*:*:*:*:*","matchCriteriaId":"23505544-DAC7-4C1F-97E4-02E13E1E3C41"},{"vulnerable":true,"criteria":"cpe:2.3:a:siemens:siveillance_video_open_network_bridge:2019:r2:*:*:*:*:*:*","matchCriteriaId":"D4A23006-E5B5-4164-9230-1E4DEF33577E"},{"vulnerable":true,"criteria":"cpe:2.3:a:siemens:siveillance_video_open_network_bridge:2019:r3:*:*:*:*:*:*","matchCriteriaId":"9519AB27-BAF0-4837-B4E8-56814D00BB8D"},{"vulnerable":true,"criteria":"cpe:2.3:a:siemens:siveillance_video_open_network_bridge:2020:r1:*:*:*:*:*:*","matchCriteriaId":"FEBEEC11-F400-46F5-B285-1247735F97EF"},{"vulnerable":true,"criteria":"cpe:2.3:a:siemens:siveillance_video_open_network_bridge:2020:r2:*:*:*:*:*:*","matchCriteriaId":"C80F5250-CBA7-40DB-BFB6-B74007715EE2"},{"vulnerable":true,"criteria":"cpe:2.3:a:siemens:siveillance_video_open_network_bridge:2020:r3:*:*:*:*:*:*","matchCriteriaId":"F53DC222-1181-4573-9ED1-9750D35E65A7"}]}]}],"references":[{"url":"https://cert-portal.siemens.com/productcert/pdf/ssa-853866.pdf","source":"productcert@siemens.com","tags":["Vendor Advisory"]},{"url":"https://cert-portal.siemens.com/productcert/pdf/ssa-853866.pdf","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Vendor Advisory"]}]}},{"cve":{"id":"CVE-2020-22002","sourceIdentifier":"cve@mitre.org","published":"2021-04-29T15:15:10.537","lastModified":"2026-06-17T03:04:02.590","vulnStatus":"Modified","cveTags":[],"descriptions":[{"lang":"en","value":"An Unauthenticated Server-Side Request Forgery (SSRF) vulnerability exists in Inim Electronics Smartliving SmartLAN/G/SI <=6.x within the GetImage functionality. The application parses user supplied data in the GET parameter 'host' to construct an image request to the service through onvif.cgi. Since no validation is carried out on the parameter, an attacker can specify an external domain and force the application to make an HTTP request to an arbitrary destination host."},{"lang":"es","value":"Se presenta una vulnerabilidad de Server-Side Request Forgery (SSRF) no autenticado en Inim Electronics Smartliving SmartLAN /G/SI versiones anteriores a incluyéndola 6.x dentro de la funcionalidad GetImage.&#xa0;La aplicación analiza los datos proporcionados por el usuario en el parámetro GET \"host\" para construir una petición de imagen al servicio por medio del archivo onvif.cgi.&#xa0;Dado que no se lleva a cabo ninguna comprobación en el parámetro, un atacante puede especificar un dominio externo y obligar a la aplicación a realizar una petición HTTP a un host de destino arbitrario"}],"affected":[{"source":"cve@mitre.org","affectedData":[{"vendor":"n/a","product":"n/a","versions":[{"version":"n/a","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":3.6}],"cvssMetricV2":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:N/I:P/A:N","baseScore":5.0,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"NONE","integrityImpact":"PARTIAL","availabilityImpact":"NONE"},"baseSeverity":"MEDIUM","exploitabilityScore":10.0,"impactScore":2.9,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}]},"weaknesses":[{"source":"nvd@nist.gov","type":"Primary","description":[{"lang":"en","value":"CWE-918"}]}],"configurations":[{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:inim:smartliving_505_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"D350C754-F555-46A0-BB06-383C3C201E30"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:inim:smartliving_505:-:*:*:*:*:*:*:*","matchCriteriaId":"30FE3762-2144-4DF6-89C1-2181E15ACCF4"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:inim:smartliving_515_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"5F96A2F0-E829-416E-9D19-C2820F16A954"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:inim:smartliving_515:-:*:*:*:*:*:*:*","matchCriteriaId":"1EBA5461-77FB-46E5-BFDC-F470A9A97492"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:inim:smartliving_1050_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"467D8264-AD90-4AFE-BB6E-D1D62279E481"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:inim:smartliving_1050:-:*:*:*:*:*:*:*","matchCriteriaId":"1BB1029D-DC9C-444A-BCE3-AF1BE074A068"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:inim:smartliving_1050g3_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"2BB20EF9-386F-4C5E-A4F7-B6E03E71E809"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:inim:smartliving_1050g3:-:*:*:*:*:*:*:*","matchCriteriaId":"0BF688BA-60F1-4F19-8CFA-6C1EFB4D4128"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:inim:smartliving_10100l_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"12BD7C5C-3A1F-4900-B516-F72FD46F5B18"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:inim:smartliving_10100l:-:*:*:*:*:*:*:*","matchCriteriaId":"5537E090-43C2-42B1-A793-23E765A82D6E"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:inim:smartliving_10100lg3_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"57A3F264-9B28-4B14-AC5A-A7DA010CA991"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:inim:smartliving_10100lg3:-:*:*:*:*:*:*:*","matchCriteriaId":"108A7416-7196-49E8-9181-CE27C9F1ED11"}]}]}],"references":[{"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/172839","source":"cve@mitre.org","tags":["Third Party Advisory","VDB Entry"]},{"url":"https://www.zeroscience.mk/en/vulnerabilities/ZSL-2019-5545.php","source":"cve@mitre.org","tags":["Exploit","Third Party Advisory"]},{"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/172839","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory","VDB Entry"]},{"url":"https://www.zeroscience.mk/en/vulnerabilities/ZSL-2019-5545.php","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Exploit","Third Party Advisory"]}]}},{"cve":{"id":"CVE-2020-15744","sourceIdentifier":"cve-requests@bitdefender.com","published":"2021-08-30T10:15:15.717","lastModified":"2026-06-17T02:57:08.367","vulnStatus":"Modified","cveTags":[],"descriptions":[{"lang":"en","value":"Stack-based Buffer Overflow vulnerability in the ONVIF server component of Victure PC420 smart camera allows an attacker to execute remote code on the target device. This issue affects: Victure PC420 firmware version 1.2.2 and prior versions."},{"lang":"es","value":"Una vulnerabilidad de desbordamiento del búfer en la región stack de la memoria en el componente del servidor ONVIF de la cámara inteligente Victure PC420, permite a un atacante ejecutar código remoto en el dispositivo de destino. Este problema afecta: Victure PC420 versiones del firmware 1.2.2  y versiones anteriores."}],"affected":[{"source":"cve-requests@bitdefender.com","affectedData":[{"vendor":"Victure","product":"PC420","versions":[{"version":"unspecified","lessThanOrEqual":"1.2.2","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"cve-requests@bitdefender.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","baseScore":9.6,"baseSeverity":"CRITICAL","attackVector":"ADJACENT_NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":6.0},{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":9.8,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":5.9}],"cvssMetricV2":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:C/I:C/A:C","baseScore":10.0,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"COMPLETE","integrityImpact":"COMPLETE","availabilityImpact":"COMPLETE"},"baseSeverity":"HIGH","exploitabilityScore":10.0,"impactScore":10.0,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}]},"weaknesses":[{"source":"cve-requests@bitdefender.com","type":"Secondary","description":[{"lang":"en","value":"CWE-121"}]},{"source":"nvd@nist.gov","type":"Primary","description":[{"lang":"en","value":"CWE-787"}]}],"configurations":[{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:govicture:pc420_firmware:*:*:*:*:*:*:*:*","versionEndIncluding":"1.2.2","matchCriteriaId":"ADDB86AF-C053-4796-804E-6A105358225D"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:govicture:pc420:-:*:*:*:*:*:*:*","matchCriteriaId":"3D51F2A1-5B4A-468F-862E-C426F29A8EED"}]}]}],"references":[{"url":"https://www.bitdefender.com/blog/labs/cracking-the-victure-pc420-camera","source":"cve-requests@bitdefender.com","tags":["Third Party Advisory"]},{"url":"https://www.bitdefender.com/blog/labs/cracking-the-victure-pc420-camera","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory"]}]}},{"cve":{"id":"CVE-2022-30563","sourceIdentifier":"cybersecurity@dahuatech.com","published":"2022-06-28T14:15:08.220","lastModified":"2026-06-17T04:43:51.887","vulnStatus":"Modified","cveTags":[],"descriptions":[{"lang":"en","value":"When an attacker uses a man-in-the-middle attack to sniff the request packets with success logging in through ONVIF, he can log in to the device by replaying the user's login packet."},{"lang":"es","value":"Cuando un atacante usa un ataque de tipo man-in-the-middle para olfatear los paquetes de petición con éxito de inicio de sesión mediante ONVIF, puede entrar en el dispositivo al reproducir el paquete de inicio de sesión del usuario"}],"affected":[{"source":"cybersecurity@dahuatech.com","affectedData":[{"vendor":"n/a","product":"IPCHDBW2XXX[IPCHFW2XXX[ASI7XXXX","versions":[{"version":"Versions which Build time before April, 2022","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","baseScore":7.4,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":2.2,"impactScore":5.2}],"cvssMetricV2":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:M/Au:N/C:P/I:P/A:N","baseScore":5.8,"accessVector":"NETWORK","accessComplexity":"MEDIUM","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"NONE"},"baseSeverity":"MEDIUM","exploitabilityScore":8.6,"impactScore":4.9,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}]},"weaknesses":[{"source":"nvd@nist.gov","type":"Primary","description":[{"lang":"en","value":"NVD-CWE-noinfo"}]}],"configurations":[{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:dahuasecurity:ipc-hdbw2431e-s-s2_firmware:*:*:*:*:*:*:*:*","versionEndExcluding":"2022-04","matchCriteriaId":"D2D2136E-8A6C-47C0-93B9-3871CE3BEE68"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:dahuasecurity:ipc-hdbw2431e-s-s2:-:*:*:*:*:*:*:*","matchCriteriaId":"EDE496EA-85DC-4296-A50D-0D0E1DABE0F8"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:dahuasecurity:ipc-hdbw2831e-s-s2_firmware:*:*:*:*:*:*:*:*","versionEndExcluding":"2022-04","matchCriteriaId":"9D203BA6-F0AD-4E8B-BEF2-5C5F69944629"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:dahuasecurity:ipc-hdbw2831e-s-s2:-:*:*:*:*:*:*:*","matchCriteriaId":"EEE1F283-44C0-4CC1-86C6-8DC47050EC66"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:dahuasecurity:ipc-hdbw2230e-s-s2_firmware:*:*:*:*:*:*:*:*","versionEndExcluding":"2022-04","matchCriteriaId":"C82E57C7-AC82-4D00-A819-7D8E1BBE81DF"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:dahuasecurity:ipc-hdbw2230e-s-s2:-:*:*:*:*:*:*:*","matchCriteriaId":"04E8A3A8-CA9F-460D-8592-D536B1810B2E"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:dahuasecurity:ipc-hdbw2831r-zs-s2_firmware:*:*:*:*:*:*:*:*","versionEndExcluding":"2022-04","matchCriteriaId":"79095CD2-EDA3-44A2-9A7D-D41C17892D0A"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:dahuasecurity:ipc-hdbw2831r-zs-s2:-:*:*:*:*:*:*:*","matchCriteriaId":"ECF9F5B4-0285-4C50-914D-8815ECE30E36"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:dahuasecurity:ipc-hdbw2831r-zas-s2_firmware:*:*:*:*:*:*:*:*","versionEndExcluding":"2022-04","matchCriteriaId":"BF22A8E2-29CA-4533-BE49-8E8B676A94CA"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:dahuasecurity:ipc-hdbw2831r-zas-s2:-:*:*:*:*:*:*:*","matchCriteriaId":"4AF7827F-FC58-46DF-A8A8-04B0AFECEC8A"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:dahuasecurity:ipc-hdbw2831e-s-s2_firmware:*:*:*:*:*:*:*:*","versionEndExcluding":"2022-04","matchCriteriaId":"9D203BA6-F0AD-4E8B-BEF2-5C5F69944629"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:dahuasecurity:ipc-hdbw2831e-s-s2:-:*:*:*:*:*:*:*","matchCriteriaId":"EEE1F283-44C0-4CC1-86C6-8DC47050EC66"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:dahuasecurity:ipc-hdbw2531r-zs-s2_firmware:*:*:*:*:*:*:*:*","versionEndExcluding":"2022-04","matchCriteriaId":"B4982CF9-D732-4B89-9CB1-D9E0C46C4F7A"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:dahuasecurity:ipc-hdbw2531r-zs-s2:-:*:*:*:*:*:*:*","matchCriteriaId":"4FCD64D9-283F-4ADA-A8EA-F37C2DE8ED1C"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:dahuasecurity:ipc-hdbw2531r-zas-s2_firmware:*:*:*:*:*:*:*:*","versionEndExcluding":"2022-04","matchCriteriaId":"BF2503CD-E1BA-45F8-96B7-260A545F5AB3"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:dahuasecurity:ipc-hdbw2531r-zas-s2:-:*:*:*:*:*:*:*","matchCriteriaId":"0D4AEF56-C239-442E-AC20-54E488F3FB8F"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:dahuasecurity:ipc-hdbw2531e-s-s2_firmware:*:*:*:*:*:*:*:*","versionEndExcluding":"2022-04","matchCriteriaId":"A4A638CB-336F-4B3A-B549-A14B33758B93"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:dahuasecurity:ipc-hdbw2531e-s-s2:-:*:*:*:*:*:*:*","matchCriteriaId":"B502A114-3608-4A30-B255-ED8CFA72FFC2"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:dahuasecurity:ipc-hdbw2431r-zs-s2_firmware:*:*:*:*:*:*:*:*","versionEndExcluding":"2022-04","matchCriteriaId":"AD01632F-E921-4720-AC2D-D4EE8DBFE6C9"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:dahuasecurity:ipc-hdbw2431r-zs-s2:-:*:*:*:*:*:*:*","matchCriteriaId":"4C49C7E4-2488-4322-B143-8589B6E1047B"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:dahuasecurity:ipc-hdbw2431r-zas-s2_firmware:*:*:*:*:*:*:*:*","versionEndExcluding":"2022-04","matchCriteriaId":"CB313905-6AB1-43CE-B797-0D86129F0E1F"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:dahuasecurity:ipc-hdbw2431r-zas-s2:-:*:*:*:*:*:*:*","matchCriteriaId":"751DB155-2773-4242-AEED-946DB1D86CF8"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:dahuasecurity:ipc-hdbw2231f-as-s2_firmware:*:*:*:*:*:*:*:*","versionEndExcluding":"2022-04","matchCriteriaId":"75B3628E-2FA5-49F8-A7B8-30247B274168"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:dahuasecurity:ipc-hdbw2231f-as-s2:-:*:*:*:*:*:*:*","matchCriteriaId":"F3C4CA86-8C93-4CB0-9561-798A03D3931F"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:dahuasecurity:ipc-hdbw2231e-s-s2_firmware:*:*:*:*:*:*:*:*","versionEndExcluding":"2022-04","matchCriteriaId":"84DC0F33-23D5-4DE8-A65A-CE58231A8C63"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:dahuasecurity:ipc-hdbw2231e-s-s2:-:*:*:*:*:*:*:*","matchCriteriaId":"4ED0EBF0-08FC-4163-A568-D8873C37218A"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:dahuasecurity:ipc-hdbw2231r-zs-s2_firmware:*:*:*:*:*:*:*:*","versionEndExcluding":"2022-04","matchCriteriaId":"E29F1DAC-7654-44C4-B4EA-E9D85C1CD037"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:dahuasecurity:ipc-hdbw2231r-zs-s2:-:*:*:*:*:*:*:*","matchCriteriaId":"9223BB3E-DB75-4CED-B218-99EFD07CD0D4"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:dahuasecurity:ipc-hdbw2231r-zas-s2_firmware:*:*:*:*:*:*:*:*","versionEndExcluding":"2022-04","matchCriteriaId":"B82708A2-F5ED-4EC8-88A2-1DB49473D627"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:dahuasecurity:ipc-hdbw2231r-zas-s2:-:*:*:*:*:*:*:*","matchCriteriaId":"2C421C30-565C-4E1F-8C86-6C933E16B55A"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:dahuasecurity:ipc-hfw2231m-as-i2-b-s2_firmware:*:*:*:*:*:*:*:*","versionEndExcluding":"2022-04","matchCriteriaId":"89E0C19F-582E-4AEE-8FD7-F93B6A7A426B"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:dahuasecurity:ipc-hfw2231m-as-i2-b-s2:-:*:*:*:*:*:*:*","matchCriteriaId":"293A1687-4969-49A0-9EAC-361DEE22C642"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:dahuasecurity:ipc-hfw2231t-as-s2_firmware:*:*:*:*:*:*:*:*","versionEndExcluding":"2022-04","matchCriteriaId":"D8AC4C0A-1CE4-458D-9530-83E388A61F6D"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:dahuasecurity:ipc-hfw2231t-as-s2:-:*:*:*:*:*:*:*","matchCriteriaId":"0613F006-1910-4B81-80F8-72F03B0172ED"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:dahuasecurity:ipc-hfw2231s-s-s2_firmware:*:*:*:*:*:*:*:*","versionEndExcluding":"2022-04","matchCriteriaId":"1801A63E-9AAD-45F8-A423-D6B7BA5A8DFC"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:dahuasecurity:ipc-hfw2231s-s-s2:-:*:*:*:*:*:*:*","matchCriteriaId":"67378776-C0DC-4439-94C4-49E62BB2FB40"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:dahuasecurity:ipc-hfw2231t-zs-s2_firmware:*:*:*:*:*:*:*:*","versionEndExcluding":"2022-04","matchCriteriaId":"B3986C0C-F128-496B-8580-FD220F262A1A"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:dahuasecurity:ipc-hfw2231t-zs-s2:-:*:*:*:*:*:*:*","matchCriteriaId":"D0CDC574-B581-4D58-85CB-129DA9EAB8E1"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:dahuasecurity:ipc-hfw2231t-zas-s2_firmware:*:*:*:*:*:*:*:*","versionEndExcluding":"2022-04","matchCriteriaId":"C6B73B4D-7B4A-4B9C-ADBE-7D759365E6D5"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:dahuasecurity:ipc-hfw2231t-zas-s2:-:*:*:*:*:*:*:*","matchCriteriaId":"A434E8FD-B383-492B-AA09-B50907E0A1AD"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:dahuasecurity:ipc-hfw2230s-s-s2_firmware:*:*:*:*:*:*:*:*","versionEndExcluding":"2022-04","matchCriteriaId":"68E4F188-7958-4FF3-8495-6CB59047F34D"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:dahuasecurity:ipc-hfw2230s-s-s2:-:*:*:*:*:*:*:*","matchCriteriaId":"A938A132-CD35-42D8-A359-F69EB5CF907C"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:dahuasecurity:ipc-hfw2431t-as-s2_firmware:*:*:*:*:*:*:*:*","versionEndExcluding":"2022-04","matchCriteriaId":"DFECF62C-7935-4ABF-BE09-C2FFB2BFFC10"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:dahuasecurity:ipc-hfw2431t-as-s2:-:*:*:*:*:*:*:*","matchCriteriaId":"04EBAA98-A8EA-4B34-AE18-E159EF7F2407"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:dahuasecurity:ipc-hfw2431t-zs-s2_firmware:*:*:*:*:*:*:*:*","versionEndExcluding":"2022-04","matchCriteriaId":"917E6ED4-7B78-4724-BD57-52A0C7A3E37B"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:dahuasecurity:ipc-hfw2431t-zs-s2:-:*:*:*:*:*:*:*","matchCriteriaId":"E6416818-54D3-4EF0-A635-DE4D14E3721E"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:dahuasecurity:ipc-hfw2431t-zas-s2_firmware:*:*:*:*:*:*:*:*","versionEndExcluding":"2022-04","matchCriteriaId":"D4D24218-651C-4F08-B7B0-A5BB2067A3E7"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:dahuasecurity:ipc-hfw2431t-zas-s2:-:*:*:*:*:*:*:*","matchCriteriaId":"BAC0FFE5-9039-48AC-ABA9-6A60BC08D8B8"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:dahuasecurity:ipc-hfw2431s-s-s2_firmware:*:*:*:*:*:*:*:*","versionEndExcluding":"2022-04","matchCriteriaId":"EB1F2D8C-8DC0-4598-A0D5-2FD81E4C0F25"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:dahuasecurity:ipc-hfw2431s-s-s2:-:*:*:*:*:*:*:*","matchCriteriaId":"14316C52-D598-48D6-83DD-4BDC09B40B6C"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:dahuasecurity:ipc-hfw2531t-as-s2_firmware:*:*:*:*:*:*:*:*","versionEndExcluding":"2022-04","matchCriteriaId":"1E89D7E9-C67F-4514-B901-8D357EF27E57"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:dahuasecurity:ipc-hfw2531t-as-s2:-:*:*:*:*:*:*:*","matchCriteriaId":"93792C46-D2EB-45E9-87D9-CA2ABC2C0FD4"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:dahuasecurity:ipc-hfw2531t-zs-s2_firmware:*:*:*:*:*:*:*:*","versionEndExcluding":"2022-04","matchCriteriaId":"4D4F4709-68F6-4970-A98A-174FB2DA8D7F"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:dahuasecurity:ipc-hfw2531t-zs-s2:-:*:*:*:*:*:*:*","matchCriteriaId":"38CC5CD7-C84E-432E-B899-8DE9D7C88DBF"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:dahuasecurity:ipc-hfw2531t-zas-s2_firmware:*:*:*:*:*:*:*:*","versionEndExcluding":"2022-04","matchCriteriaId":"78C7E8E1-DAB1-4646-A375-6B8B6AD92118"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:dahuasecurity:ipc-hfw2531t-zas-s2:-:*:*:*:*:*:*:*","matchCriteriaId":"455A3C1E-F89F-405C-A8A8-3F726DC3D8E3"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:dahuasecurity:ipc-hfw2531s-s-s2_firmware:*:*:*:*:*:*:*:*","versionEndExcluding":"2022-04","matchCriteriaId":"26B5216C-DE03-4A57-9793-914E2DC1690B"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:dahuasecurity:ipc-hfw2531s-s-s2:-:*:*:*:*:*:*:*","matchCriteriaId":"AD0FBFD4-48BD-40D4-B001-25F629DB3DB9"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:dahuasecurity:ipc-hfw2831t-as-s2_firmware:*:*:*:*:*:*:*:*","versionEndExcluding":"2022-04","matchCriteriaId":"ED62ABE0-14ED-46BE-B663-1B7EF7562527"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:dahuasecurity:ipc-hfw2831t-as-s2:-:*:*:*:*:*:*:*","matchCriteriaId":"77601790-A970-470B-8F19-B3B240C93CC0"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:dahuasecurity:ipc-hfw2831t-zs-s2_firmware:*:*:*:*:*:*:*:*","versionEndExcluding":"2022-04","matchCriteriaId":"199EC4C8-8634-43BC-B3CC-9FED500F5A98"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:dahuasecurity:ipc-hfw2831t-zs-s2:-:*:*:*:*:*:*:*","matchCriteriaId":"6F301148-0026-4D64-89BD-8DD36D70AF7F"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:dahuasecurity:ipc-hfw2831t-zas-s2_firmware:*:*:*:*:*:*:*:*","versionEndExcluding":"2022-04","matchCriteriaId":"8E43EC67-9451-4A7E-9F72-B84B924331B6"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:dahuasecurity:ipc-hfw2831t-zas-s2:-:*:*:*:*:*:*:*","matchCriteriaId":"3D22E1AE-01AD-43EE-B9A8-CE2B32DE1819"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:dahuasecurity:ipc-hfw2831s-s-s2_firmware:*:*:*:*:*:*:*:*","versionEndExcluding":"2022-04","matchCriteriaId":"D017BEAA-DB78-4A1C-A78B-6631A6AD4588"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:dahuasecurity:ipc-hfw2831s-s-s2:-:*:*:*:*:*:*:*","matchCriteriaId":"E908BEA7-A7C1-48C6-9991-9BA9EB0F2920"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:dahuasecurity:ipc-hfw2439m-as-led-b-s2_firmware:*:*:*:*:*:*:*:*","versionEndExcluding":"2022-04","matchCriteriaId":"1B43845D-D1FB-4CB7-81D7-E02F5672A201"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:dahuasecurity:ipc-hfw2439m-as-led-b-s2:-:*:*:*:*:*:*:*","matchCriteriaId":"88C84E4C-5652-4177-B19D-3F85F6BB7B15"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:dahuasecurity:ipc-hfw2239m-as-led-b-s2_firmware:*:*:*:*:*:*:*:*","versionEndExcluding":"2022-04","matchCriteriaId":"2179D498-68E9-4F2F-A0DE-1AAC5B5C0590"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:dahuasecurity:ipc-hfw2239m-as-led-b-s2:-:*:*:*:*:*:*:*","matchCriteriaId":"1FFE18FA-F8E1-401E-B867-8415CB16469C"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:dahuasecurity:ipc-hfw2439s-sa-led-s2_firmware:*:*:*:*:*:*:*:*","versionEndExcluding":"2022-04","matchCriteriaId":"E59C28BD-2D7A-4A3F-876A-F4B89FABD0C4"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:dahuasecurity:ipc-hfw2439s-sa-led-s2:-:*:*:*:*:*:*:*","matchCriteriaId":"3C7C6489-A37F-4CB8-A0D1-1070CEA50DF1"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:dahuasecurity:ipc-hfw2239s-sa-led-s2_firmware:*:*:*:*:*:*:*:*","versionEndExcluding":"2022-04","matchCriteriaId":"7A2B2F74-CC5C-4930-883A-59387633BBFF"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:dahuasecurity:ipc-hfw2239s-sa-led-s2:-:*:*:*:*:*:*:*","matchCriteriaId":"A088EE14-18A7-400D-A97F-2D37165241F9"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:dahuasecurity:asi7213x-t1_firmware:*:*:*:*:*:*:*:*","versionEndExcluding":"2021-09","matchCriteriaId":"944B9FEB-944F-4D18-9AB8-E208B4ED8D09"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:dahuasecurity:asi7213x-t1:-:*:*:*:*:*:*:*","matchCriteriaId":"61A21D72-F158-4A0D-9B47-F51583F953FC"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:dahuasecurity:asi7223x-a-t1_firmware:*:*:*:*:*:*:*:*","versionEndExcluding":"2021-09","matchCriteriaId":"D48A9CDB-92BB-46B3-998E-10159C71DEF6"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:dahuasecurity:asi7223x-a-t1:-:*:*:*:*:*:*:*","matchCriteriaId":"B619AF87-B6B1-4470-BB67-83E2CCFD22AD"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:dahuasecurity:asi7223x-a_firmware:*:*:*:*:*:*:*:*","versionEndExcluding":"2021-09","matchCriteriaId":"FF4EFA0E-6636-4CAD-80C0-501D97DEDA43"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:dahuasecurity:asi7223x-a:-:*:*:*:*:*:*:*","matchCriteriaId":"8F444CEE-EE2A-4AAC-A89F-65F72F7EC0D9"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:dahuasecurity:asi7213x_firmware:*:*:*:*:*:*:*:*","versionEndExcluding":"2021-09","matchCriteriaId":"0506B29B-78D7-4347-991C-516C38C62ED5"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:dahuasecurity:asi7213x:-:*:*:*:*:*:*:*","matchCriteriaId":"D4C15C01-8DFC-4036-AF76-1B1608E75523"}]}]}],"references":[{"url":"https://www.dahuasecurity.com/support/cybersecurity/details/1017","source":"cybersecurity@dahuatech.com","tags":["Vendor Advisory"]},{"url":"https://www.dahuasecurity.com/support/cybersecurity/details/1017","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Vendor Advisory"]}]}},{"cve":{"id":"CVE-2023-51625","sourceIdentifier":"zdi-disclosures@trendmicro.com","published":"2024-05-03T03:16:25.543","lastModified":"2026-06-17T06:41:21.140","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"D-Link DCS-8300LHV2 ONVIF SetSystemDateAndTime Command Injection Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DCS-8300LHV2 IP cameras. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed.\n\nThe specific flaw exists within the implementation of the ONVIF API, which listens on TCP port 80. When parsing the sch:TZ XML element, the process does not properly validate a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-21319."},{"lang":"es","value":"Vulnerabilidad de ejecución remota de código de inyección de comando D-Link DCS-8300LHV2 ONVIF SetSystemDateAndTime. Esta vulnerabilidad permite a atacantes adyacentes a la red ejecutar código arbitrario en instalaciones afectadas de cámaras IP D-Link DCS-8300LHV2. Aunque se requiere autenticación para aprovechar esta vulnerabilidad, se puede omitir el mecanismo de autenticación existente. La falla específica existe en la implementación de la API ONVIF, que escucha en el puerto TCP 80. Al analizar el elemento XML sch:TZ, el proceso no valida adecuadamente una cadena proporcionada por el usuario antes de usarla para ejecutar una llamada al sistema. Un atacante puede aprovechar esta vulnerabilidad para ejecutar código en el contexto de la raíz. Era ZDI-CAN-21319."}],"affected":[{"source":"zdi-disclosures@trendmicro.com","affectedData":[{"vendor":"D-Link","product":"DCS-8300LHV2","defaultStatus":"unknown","versions":[{"version":"1.06.01","status":"affected"}]}]},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","affectedData":[{"vendor":"d-link","product":"DCS-8300LHV2","defaultStatus":"unknown","cpes":["cpe:2.3:a:d-link:DCS-8300LHV2:1.06.01:*:*:*:*:*:*:*"],"versions":[{"version":"1.06.01","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":8.0,"baseSeverity":"HIGH","attackVector":"ADJACENT_NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.1,"impactScore":5.9}],"cvssMetricV30":[{"source":"zdi-disclosures@trendmicro.com","type":"Secondary","cvssData":{"version":"3.0","vectorString":"CVSS:3.0/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":8.0,"baseSeverity":"HIGH","attackVector":"ADJACENT_NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.1,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2024-05-03T16:23:59.825714Z","id":"CVE-2023-51625","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"zdi-disclosures@trendmicro.com","type":"Secondary","description":[{"lang":"en","value":"CWE-78"}]},{"source":"nvd@nist.gov","type":"Primary","description":[{"lang":"en","value":"CWE-78"}]}],"configurations":[{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:dlink:dcs-8300lhv2_firmware:*:*:*:*:*:*:*:*","versionEndExcluding":"1.07.02","matchCriteriaId":"B5E6108B-5223-48D0-ACD3-56A21F091F6C"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:dlink:dcs-8300lhv2:-:*:*:*:*:*:*:*","matchCriteriaId":"370C3425-5B83-4E93-9C84-FA625EFB93EC"}]}]}],"references":[{"url":"https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10370","source":"zdi-disclosures@trendmicro.com","tags":["Vendor Advisory"]},{"url":"https://www.zerodayinitiative.com/advisories/ZDI-24-045/","source":"zdi-disclosures@trendmicro.com","tags":["Third Party Advisory"]},{"url":"https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10370","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Vendor Advisory"]},{"url":"https://www.zerodayinitiative.com/advisories/ZDI-24-045/","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory"]}]}},{"cve":{"id":"CVE-2023-51627","sourceIdentifier":"zdi-disclosures@trendmicro.com","published":"2024-05-03T03:16:25.893","lastModified":"2026-06-17T06:41:21.387","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"D-Link DCS-8300LHV2 ONVIF Duration Stack-Based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DCS-8300LHV2 IP cameras. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed.\n\nThe specific flaw exists within the parsing of Duration XML elements. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-21321."},{"lang":"es","value":"Vulnerabilidad de ejecución remota de código de desbordamiento de búfer en la región stack de la memoria de duración ONVIF de D-Link DCS-8300LHV2. Esta vulnerabilidad permite a atacantes adyacentes a la red ejecutar código arbitrario en instalaciones afectadas de cámaras IP D-Link DCS-8300LHV2. Aunque se requiere autenticación para aprovechar esta vulnerabilidad, se puede omitir el mecanismo de autenticación existente. La falla específica existe en el análisis de elementos XML de duración. El problema se debe a la falta de una validación adecuada de la longitud de los datos proporcionados por el usuario antes de copiarlos en un búfer basado en pila de longitud fija. Un atacante puede aprovechar esta vulnerabilidad para ejecutar código en el contexto de la raíz. Era ZDI-CAN-21321."}],"affected":[{"source":"zdi-disclosures@trendmicro.com","affectedData":[{"vendor":"D-Link","product":"DCS-8300LHV2","defaultStatus":"unknown","versions":[{"version":"1.06.01","status":"affected"}]}]},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","affectedData":[{"vendor":"dlink","product":"dcs-8300lvh2_firmware","defaultStatus":"unknown","cpes":["cpe:2.3:o:dlink:dcs-8300lvh2_firmware:1.06.01:*:*:*:*:*:*:*"],"versions":[{"version":"1.06.01","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":8.0,"baseSeverity":"HIGH","attackVector":"ADJACENT_NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.1,"impactScore":5.9}],"cvssMetricV30":[{"source":"zdi-disclosures@trendmicro.com","type":"Secondary","cvssData":{"version":"3.0","vectorString":"CVSS:3.0/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":8.0,"baseSeverity":"HIGH","attackVector":"ADJACENT_NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.1,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2024-05-06T17:54:32.999025Z","id":"CVE-2023-51627","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"zdi-disclosures@trendmicro.com","type":"Secondary","description":[{"lang":"en","value":"CWE-121"}]},{"source":"nvd@nist.gov","type":"Primary","description":[{"lang":"en","value":"CWE-787"}]}],"configurations":[{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:dlink:dcs-8300lhv2_firmware:*:*:*:*:*:*:*:*","versionEndExcluding":"1.07.02","matchCriteriaId":"B5E6108B-5223-48D0-ACD3-56A21F091F6C"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:dlink:dcs-8300lhv2:-:*:*:*:*:*:*:*","matchCriteriaId":"370C3425-5B83-4E93-9C84-FA625EFB93EC"}]}]}],"references":[{"url":"https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10370","source":"zdi-disclosures@trendmicro.com","tags":["Vendor Advisory"]},{"url":"https://www.zerodayinitiative.com/advisories/ZDI-24-047/","source":"zdi-disclosures@trendmicro.com","tags":["Third Party Advisory"]},{"url":"https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10370","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Vendor Advisory"]},{"url":"https://www.zerodayinitiative.com/advisories/ZDI-24-047/","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory"]}]}},{"cve":{"id":"CVE-2023-51628","sourceIdentifier":"zdi-disclosures@trendmicro.com","published":"2024-05-03T03:16:26.093","lastModified":"2026-06-17T06:41:21.523","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"D-Link DCS-8300LHV2 ONVIF SetHostName Stack-Based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DCS-8300LHV2 IP cameras. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed.\n\nThe specific flaw exists within the handling of the SetHostName ONVIF call. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-21322."},{"lang":"es","value":"Vulnerabilidad de ejecución remota de código de desbordamiento de búfer en la región stack de la memoria de D-Link DCS-8300LHV2 ONVIF SetHostName. Esta vulnerabilidad permite a atacantes adyacentes a la red ejecutar código arbitrario en instalaciones afectadas de cámaras IP D-Link DCS-8300LHV2. Aunque se requiere autenticación para aprovechar esta vulnerabilidad, se puede omitir el mecanismo de autenticación existente. La falla específica existe en el manejo de la llamada ONVIF SetHostName. El problema se debe a la falta de una validación adecuada de la longitud de los datos proporcionados por el usuario antes de copiarlos en un búfer basado en pila de longitud fija. Un atacante puede aprovechar esta vulnerabilidad para ejecutar código en el contexto de la raíz. Era ZDI-CAN-21322."}],"affected":[{"source":"zdi-disclosures@trendmicro.com","affectedData":[{"vendor":"D-Link","product":"DCS-8300LHV2","defaultStatus":"unknown","versions":[{"version":"1.06.01","status":"affected"}]}]},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","affectedData":[{"vendor":"dlink","product":"dcs-8300lvh2_firmware","defaultStatus":"unknown","cpes":["cpe:2.3:o:dlink:dcs-8300lvh2_firmware:1.06.01:*:*:*:*:*:*:*"],"versions":[{"version":"1.06.01","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":8.0,"baseSeverity":"HIGH","attackVector":"ADJACENT_NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.1,"impactScore":5.9}],"cvssMetricV30":[{"source":"zdi-disclosures@trendmicro.com","type":"Secondary","cvssData":{"version":"3.0","vectorString":"CVSS:3.0/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":8.0,"baseSeverity":"HIGH","attackVector":"ADJACENT_NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.1,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2024-05-06T17:54:37.587648Z","id":"CVE-2023-51628","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"zdi-disclosures@trendmicro.com","type":"Secondary","description":[{"lang":"en","value":"CWE-121"}]},{"source":"nvd@nist.gov","type":"Primary","description":[{"lang":"en","value":"CWE-787"}]}],"configurations":[{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:dlink:dcs-8300lhv2_firmware:*:*:*:*:*:*:*:*","versionEndExcluding":"1.07.02","matchCriteriaId":"B5E6108B-5223-48D0-ACD3-56A21F091F6C"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:dlink:dcs-8300lhv2:-:*:*:*:*:*:*:*","matchCriteriaId":"370C3425-5B83-4E93-9C84-FA625EFB93EC"}]}]}],"references":[{"url":"https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10370","source":"zdi-disclosures@trendmicro.com","tags":["Vendor Advisory"]},{"url":"https://www.zerodayinitiative.com/advisories/ZDI-24-048/","source":"zdi-disclosures@trendmicro.com","tags":["Third Party Advisory"]},{"url":"https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10370","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Vendor Advisory"]},{"url":"https://www.zerodayinitiative.com/advisories/ZDI-24-048/","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory"]}]}},{"cve":{"id":"CVE-2023-51629","sourceIdentifier":"zdi-disclosures@trendmicro.com","published":"2024-05-03T03:16:26.273","lastModified":"2026-06-17T06:41:21.660","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"D-Link DCS-8300LHV2 ONVIF Hardcoded PIN Authentication Bypass Vulnerability. This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of D-Link DCS-8300LHV2 IP cameras. Authentication is not required to exploit this vulnerability.\n\nThe specific flaw exists within the configuration of the ONVIF API. The issue results from the use of a hardcoded PIN. An attacker can leverage this vulnerability to bypass authentication on the system. Was ZDI-CAN-21492."},{"lang":"es","value":"Vulnerabilidad de omisión de autenticación con PIN codificado ONVIF de D-Link DCS-8300LHV2. Esta vulnerabilidad permite a atacantes adyacentes a la red eludir la autenticación en las instalaciones afectadas de cámaras IP D-Link DCS-8300LHV2. No se requiere autenticación para aprovechar esta vulnerabilidad. La falla específica existe dentro de la configuración de la API ONVIF. El problema se debe al uso de un PIN codificado. Un atacante puede aprovechar esta vulnerabilidad para eludir la autenticación en el sistema. Era ZDI-CAN-21492."}],"affected":[{"source":"zdi-disclosures@trendmicro.com","affectedData":[{"vendor":"D-Link","product":"DCS-8300LHV2","defaultStatus":"unknown","versions":[{"version":"1.06.01","status":"affected"}]}]},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","affectedData":[{"vendor":"d-link","product":"DCS-8300LHV2","defaultStatus":"unknown","cpes":["cpe:2.3:a:d-link:DCS-8300LHV2:1.06.01:*:*:*:*:*:*:*"],"versions":[{"version":"1.06.01","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":8.8,"baseSeverity":"HIGH","attackVector":"ADJACENT_NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":5.9}],"cvssMetricV30":[{"source":"zdi-disclosures@trendmicro.com","type":"Secondary","cvssData":{"version":"3.0","vectorString":"CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","baseScore":6.3,"baseSeverity":"MEDIUM","attackVector":"ADJACENT_NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":2.8,"impactScore":3.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2024-05-03T15:05:31.378071Z","id":"CVE-2023-51629","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"zdi-disclosures@trendmicro.com","type":"Secondary","description":[{"lang":"en","value":"CWE-259"}]},{"source":"nvd@nist.gov","type":"Primary","description":[{"lang":"en","value":"CWE-798"}]}],"configurations":[{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:dlink:dcs-8300lhv2_firmware:*:*:*:*:*:*:*:*","versionEndExcluding":"1.07.02","matchCriteriaId":"B5E6108B-5223-48D0-ACD3-56A21F091F6C"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:dlink:dcs-8300lhv2:-:*:*:*:*:*:*:*","matchCriteriaId":"370C3425-5B83-4E93-9C84-FA625EFB93EC"}]}]}],"references":[{"url":"https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10370","source":"zdi-disclosures@trendmicro.com","tags":["Vendor Advisory"]},{"url":"https://www.zerodayinitiative.com/advisories/ZDI-24-049/","source":"zdi-disclosures@trendmicro.com","tags":["Third Party Advisory"]},{"url":"https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10370","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Vendor Advisory"]},{"url":"https://www.zerodayinitiative.com/advisories/ZDI-24-049/","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory"]}]}},{"cve":{"id":"CVE-2025-50777","sourceIdentifier":"cve@mitre.org","published":"2025-07-30T19:15:48.920","lastModified":"2026-07-05T01:21:51.153","vulnStatus":"Modified","cveTags":[],"descriptions":[{"lang":"en","value":"The firmware of the AZIOT 2MP Full HD Smart Wi-Fi CCTV Home Security Camera (version V1.00.02) contains an Incorrect Access Control vulnerability that allows local attackers to gain root shell access. Once accessed, the device exposes critical data including Wi-Fi credentials and ONVIF service credentials stored in plaintext, enabling further compromise of the network and connected systems."},{"lang":"es","value":"El firmware de AZIOT 2MP Full HD Smart Wi-Fi CCTV Home Security Camera (versión V1.00.02) contiene una vulnerabilidad de control de acceso incorrecto que permite a atacantes locales obtener acceso root. Una vez accedido, el dispositivo expone datos críticos, como credenciales Wi-Fi y credenciales de servicio ONVIF almacenadas en texto plano, lo que permite una mayor vulnerabilidad de la red y los sistemas conectados."}],"affected":[{"source":"cve@mitre.org","affectedData":[{"vendor":"n/a","product":"n/a","versions":[{"version":"n/a","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2025-07-30T19:23:02.165430Z","id":"CVE-2025-50777","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-284"},{"lang":"en","value":"CWE-312"}]}],"configurations":[{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:aziot:2mp_full_hd_smart_wi-fi_cctv_home_security_camera_firmware:1.00.02:*:*:*:*:*:*:*","matchCriteriaId":"BA617B16-4618-4404-92BD-6B25A12C7DA4"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:aziot:2mp_full_hd_smart_wi-fi_cctv_home_security_camera:-:*:*:*:*:*:*:*","matchCriteriaId":"FF91323D-000B-41DB-A110-DDD1DD676039"}]}]}],"references":[{"url":"https://github.com/veereshgadige/aziot-cctv-cve-2025-50777","source":"cve@mitre.org","tags":["Third Party Advisory"]}]}},{"cve":{"id":"CVE-2025-11852","sourceIdentifier":"cna@vuldb.com","published":"2025-10-16T19:15:32.227","lastModified":"2026-06-17T08:31:17.920","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"A vulnerability was found in Apeman ID71 218.53.203.117. The impacted element is an unknown function of the file /onvif/device_service of the component ONVIF Service. Performing manipulation results in missing authentication. The attack is possible to be carried out remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way."}],"affected":[{"source":"cna@vuldb.com","affectedData":[{"vendor":"Apeman","product":"ID71","modules":["ONVIF Service"],"versions":[{"version":"218.53.203.117","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":5.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"PROOF_OF_CONCEPT","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","baseScore":5.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":1.4}],"cvssMetricV2":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:P/I:N/A:N","baseScore":5.0,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"NONE","availabilityImpact":"NONE"},"baseSeverity":"MEDIUM","exploitabilityScore":10.0,"impactScore":2.9,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2025-10-16T19:58:28.572082Z","id":"CVE-2025-11852","options":[{"exploitation":"poc"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"cna@vuldb.com","type":"Secondary","description":[{"lang":"en","value":"CWE-287"},{"lang":"en","value":"CWE-306"}]}],"references":[{"url":"https://github.com/juliourena/APEMAN-Camera-PoCs/blob/main/RTSP/RTSP_Unauthenticated.md","source":"cna@vuldb.com"},{"url":"https://vuldb.com/?ctiid.328798","source":"cna@vuldb.com"},{"url":"https://vuldb.com/?id.328798","source":"cna@vuldb.com"},{"url":"https://vuldb.com/?submit.668899","source":"cna@vuldb.com"}]}},{"cve":{"id":"CVE-2025-14748","sourceIdentifier":"cna@vuldb.com","published":"2025-12-16T03:15:57.660","lastModified":"2026-06-17T08:36:30.090","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"A vulnerability was determined in Ningyuanda TC155 57.0.2.0. This affects an unknown function of the file /onvif/device_service of the component ONVIF Device Management Service. Executing manipulation of the argument FactoryDefault with the input Hard can lead to improper access controls. The attack requires access to the local network. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way."}],"affected":[{"source":"cna@vuldb.com","affectedData":[{"vendor":"Ningyuanda","product":"TC155","modules":["ONVIF Device Management Service"],"versions":[{"version":"57.0.2.0","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":2.1,"baseSeverity":"LOW","attackVector":"ADJACENT","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"LOW","vulnAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"PROOF_OF_CONCEPT","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L","baseScore":5.4,"baseSeverity":"MEDIUM","attackVector":"ADJACENT_NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":2.8,"impactScore":2.5}],"cvssMetricV2":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"2.0","vectorString":"AV:A/AC:L/Au:N/C:N/I:P/A:P","baseScore":4.8,"accessVector":"ADJACENT_NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"NONE","integrityImpact":"PARTIAL","availabilityImpact":"PARTIAL"},"baseSeverity":"MEDIUM","exploitabilityScore":6.5,"impactScore":4.9,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2025-12-16T20:48:51.659721Z","id":"CVE-2025-14748","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"cna@vuldb.com","type":"Secondary","description":[{"lang":"en","value":"CWE-266"},{"lang":"en","value":"CWE-284"}]}],"configurations":[{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:shenzhenningyuandatechnology:tc155_firmware:57.0.2.0:*:*:*:*:*:*:*","matchCriteriaId":"BC8CEF63-8B37-4D17-8C31-4BD41E7B8D5B"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:shenzhenningyuandatechnology:tc155:-:*:*:*:*:*:*:*","matchCriteriaId":"0DC27CA3-9706-448B-8C91-E413B1F05656"}]}]}],"references":[{"url":"https://github.com/pwnpwnpur1n/IoT-advisories/blob/main/TC155-Unauth-Hard-Reset.md","source":"cna@vuldb.com","tags":["Exploit","Third Party Advisory"]},{"url":"https://vuldb.com/?ctiid.336521","source":"cna@vuldb.com","tags":["Permissions Required","VDB Entry"]},{"url":"https://vuldb.com/?id.336521","source":"cna@vuldb.com","tags":["Third Party Advisory","VDB Entry"]},{"url":"https://vuldb.com/?submit.707197","source":"cna@vuldb.com","tags":["Third Party Advisory","VDB Entry"]}]}},{"cve":{"id":"CVE-2025-14749","sourceIdentifier":"cna@vuldb.com","published":"2025-12-16T03:15:57.840","lastModified":"2026-06-17T08:36:30.223","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"A vulnerability was identified in Ningyuanda TC155 57.0.2.0. This impacts an unknown function of the file /onvif/device_service of the component ONVIF PTZ Control Interface. The manipulation leads to improper access controls. The attack requires being on the local network. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way."}],"affected":[{"source":"cna@vuldb.com","affectedData":[{"vendor":"Ningyuanda","product":"TC155","modules":["ONVIF PTZ Control Interface"],"versions":[{"version":"57.0.2.0","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":2.1,"baseSeverity":"LOW","attackVector":"ADJACENT","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"PROOF_OF_CONCEPT","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","baseScore":6.3,"baseSeverity":"MEDIUM","attackVector":"ADJACENT_NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":2.8,"impactScore":3.4},{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":8.8,"baseSeverity":"HIGH","attackVector":"ADJACENT_NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":5.9}],"cvssMetricV2":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"2.0","vectorString":"AV:A/AC:L/Au:N/C:P/I:P/A:P","baseScore":5.8,"accessVector":"ADJACENT_NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"PARTIAL"},"baseSeverity":"MEDIUM","exploitabilityScore":6.5,"impactScore":6.4,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2025-12-16T20:46:17.290265Z","id":"CVE-2025-14749","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"cna@vuldb.com","type":"Secondary","description":[{"lang":"en","value":"CWE-266"},{"lang":"en","value":"CWE-284"}]}],"configurations":[{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:shenzhenningyuandatechnology:tc155_firmware:57.0.2.0:*:*:*:*:*:*:*","matchCriteriaId":"BC8CEF63-8B37-4D17-8C31-4BD41E7B8D5B"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:shenzhenningyuandatechnology:tc155:-:*:*:*:*:*:*:*","matchCriteriaId":"0DC27CA3-9706-448B-8C91-E413B1F05656"}]}]}],"references":[{"url":"https://github.com/pwnpwnpur1n/IoT-advisories/blob/main/TC155-Unauth-PTZ-Remote-Control.md","source":"cna@vuldb.com","tags":["Exploit","Third Party Advisory"]},{"url":"https://vuldb.com/?ctiid.336522","source":"cna@vuldb.com","tags":["Permissions Required","VDB Entry"]},{"url":"https://vuldb.com/?id.336522","source":"cna@vuldb.com","tags":["Third Party Advisory","VDB Entry"]},{"url":"https://vuldb.com/?submit.707198","source":"cna@vuldb.com","tags":["Third Party Advisory","VDB Entry"]}]}},{"cve":{"id":"CVE-2025-8065","sourceIdentifier":"f23511db-6c3e-4e32-a477-6aa17d310630","published":"2025-12-20T01:16:05.410","lastModified":"2026-06-17T10:06:14.603","vulnStatus":"Modified","cveTags":[],"descriptions":[{"lang":"en","value":"A stack-based buffer overflow vulnerability was identified in the ONVIF SOAP XML Parser in Tapo C200 v3 and C520WS v2.6. When processing XML tags with namespace prefixes, the parser fails to validate the prefix length before copying it to a fixed-size stack buffer.  It allowed a crafted SOAP request with an oversized namespace prefix to cause memory corruption in stack. \n\nAn unauthenticated attacker on the same local network may exploit this flaw to enable remote code execution with elevated privileges, leading to full compromise of the device."}],"affected":[{"source":"f23511db-6c3e-4e32-a477-6aa17d310630","affectedData":[{"vendor":"TP-Link Systems Inc.","product":"Tapo C200 V3","defaultStatus":"unaffected","modules":["ONVIF Server"],"versions":[{"version":"0","lessThan":"V3_1.4.5 Build 251104","versionType":"custom","status":"affected"}]},{"vendor":"TP-Link Systems Inc.","product":"Tapo C520WS v2.6","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"1.2.4 Build 260326 Rel.24666n","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"f23511db-6c3e-4e32-a477-6aa17d310630","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":8.7,"baseSeverity":"HIGH","attackVector":"ADJACENT","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"ADJACENT_NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2025-12-22T16:07:36.027962Z","id":"CVE-2025-8065","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"f23511db-6c3e-4e32-a477-6aa17d310630","type":"Secondary","description":[{"lang":"en","value":"CWE-121"}]},{"source":"nvd@nist.gov","type":"Primary","description":[{"lang":"en","value":"CWE-120"}]}],"configurations":[{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:tp-link:tapo_c200_firmware:1.3.3:build_230228:*:*:*:*:*:*","matchCriteriaId":"CABD8DE6-9904-499D-919F-9DBD42BE6762"},{"vulnerable":true,"criteria":"cpe:2.3:o:tp-link:tapo_c200_firmware:1.3.4:build_230424:*:*:*:*:*:*","matchCriteriaId":"254031B5-7CC7-4B9D-970B-FAA6EBC3EAFD"},{"vulnerable":true,"criteria":"cpe:2.3:o:tp-link:tapo_c200_firmware:1.3.5:build_230717:*:*:*:*:*:*","matchCriteriaId":"9D61B481-8262-44D4-9A1D-9967AB1805DC"},{"vulnerable":true,"criteria":"cpe:2.3:o:tp-link:tapo_c200_firmware:1.3.7:build_230920:*:*:*:*:*:*","matchCriteriaId":"50D2F368-F8C8-41E1-9360-8CDF9F89E566"},{"vulnerable":true,"criteria":"cpe:2.3:o:tp-link:tapo_c200_firmware:1.3.9:build_231019:*:*:*:*:*:*","matchCriteriaId":"EF80958C-4274-4DEA-9730-176E3E6F21F2"},{"vulnerable":true,"criteria":"cpe:2.3:o:tp-link:tapo_c200_firmware:1.3.11:build_231115:*:*:*:*:*:*","matchCriteriaId":"7AA1B7FA-D418-46B2-A530-BF67E550E38F"},{"vulnerable":true,"criteria":"cpe:2.3:o:tp-link:tapo_c200_firmware:1.3.13:build_240327:*:*:*:*:*:*","matchCriteriaId":"DC4382B5-C7EC-4B98-AF28-8D08D0771133"},{"vulnerable":true,"criteria":"cpe:2.3:o:tp-link:tapo_c200_firmware:1.3.14:build_240513:*:*:*:*:*:*","matchCriteriaId":"1FCE1F5E-E84B-4CF4-B8A4-7A3448A0D127"},{"vulnerable":true,"criteria":"cpe:2.3:o:tp-link:tapo_c200_firmware:1.3.15:build_240715:*:*:*:*:*:*","matchCriteriaId":"C05AC5C2-5BB7-499A-AE2B-414103317D47"},{"vulnerable":true,"criteria":"cpe:2.3:o:tp-link:tapo_c200_firmware:1.4.1:build_241212:*:*:*:*:*:*","matchCriteriaId":"C1ED28D6-9441-440A-81D8-EB539D50BB56"},{"vulnerable":true,"criteria":"cpe:2.3:o:tp-link:tapo_c200_firmware:1.4.2:build_250313:*:*:*:*:*:*","matchCriteriaId":"51E28752-8B46-48CD-86B5-437449AED7C0"},{"vulnerable":true,"criteria":"cpe:2.3:o:tp-link:tapo_c200_firmware:1.4.4:build_250922:*:*:*:*:*:*","matchCriteriaId":"ECBC265E-2AA6-471E-A7BE-8F35DDA28645"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:tp-link:tapo_c200:3:*:*:*:*:*:*:*","matchCriteriaId":"101FA54E-1A3D-4A38-BBD0-8DAFAC414EA3"}]}]}],"references":[{"url":"https://www.tp-link.com/en/support/download/tapo-c200/v3/#Firmware-Release-Notes","source":"f23511db-6c3e-4e32-a477-6aa17d310630"},{"url":"https://www.tp-link.com/en/support/download/tapo-c520ws/#Firmware-Release-Notes","source":"f23511db-6c3e-4e32-a477-6aa17d310630"},{"url":"https://www.tp-link.com/us/support/download/tapo-c200/v3/#Firmware-Release-Notes","source":"f23511db-6c3e-4e32-a477-6aa17d310630","tags":["Release Notes"]},{"url":"https://www.tp-link.com/us/support/download/tapo-c520ws/#Firmware-Release-Notes","source":"f23511db-6c3e-4e32-a477-6aa17d310630"},{"url":"https://www.tp-link.com/us/support/faq/4849/","source":"f23511db-6c3e-4e32-a477-6aa17d310630","tags":["Vendor Advisory"]}]}},{"cve":{"id":"CVE-2025-65856","sourceIdentifier":"cve@mitre.org","published":"2025-12-22T22:16:08.360","lastModified":"2026-07-05T17:17:24.710","vulnStatus":"Modified","cveTags":[],"descriptions":[{"lang":"en","value":"Authentication bypass vulnerability in Xiongmai XM530 IP cameras on Firmware V5.00.R02.000807D8.10010.346624.S.ONVIF 21.06 allows unauthenticated remote attackers to access sensitive device information and live video streams. The ONVIF implementation fails to enforce authentication on 31 critical endpoints, enabling direct unauthorized video stream access."}],"affected":[{"source":"cve@mitre.org","affectedData":[{"vendor":"n/a","product":"n/a","versions":[{"version":"n/a","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":9.8,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2025-12-22T21:21:20.656866Z","id":"CVE-2025-65856","options":[{"exploitation":"poc"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-306"}]}],"configurations":[{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:xiongmaitech:xm530v200_x6-weq_8m_firmware:5.00.r02.000807d8.10010.346624.s.onvif_21.06:*:*:*:*:*:*:*","matchCriteriaId":"6DFBF9B8-CA55-459F-95F9-3606B52D92B7"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:xiongmaitech:xm530v200_x6-weq_8m:-:*:*:*:*:*:*:*","matchCriteriaId":"D72FD0CF-CE0C-4466-8F42-099FA0E8D7D5"}]}]}],"references":[{"url":"https://luismirandaacebedo.github.io/CVE-2025-65856/","source":"cve@mitre.org","tags":["Exploit","Third Party Advisory"]}]}},{"cve":{"id":"CVE-2019-25290","sourceIdentifier":"disclosure@vulncheck.com","published":"2026-01-08T00:15:58.973","lastModified":"2026-06-17T02:31:59.280","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Smartliving SmartLAN/G/SI <=6.x contains an unauthenticated server-side request forgery vulnerability in the GetImage functionality through the 'host' parameter. Attackers can exploit the onvif.cgi endpoint by specifying external domains to bypass firewalls and perform network enumeration through arbitrary HTTP requests."},{"lang":"es","value":"Smartliving SmartLAN/G/SI &lt;=6.x contiene una vulnerabilidad de falsificación de petición del lado del servidor no autenticada en la funcionalidad GetImage a través del parámetro 'host'. Los atacantes pueden explotar el endpoint onvif.cgi especificando dominios externos para eludir cortafuegos y realizar enumeración de red a través de peticiones HTTP arbitrarias."}],"affected":[{"source":"disclosure@vulncheck.com","affectedData":[{"vendor":"INIM Electronics s.r.l.","product":"Smartliving SmartLAN/G/SI","versions":[{"version":"<=6.0","status":"affected"},{"version":"505","status":"affected"},{"version":"515","status":"affected"},{"version":"1050","status":"affected"},{"version":"1050/G3","status":"affected"},{"version":"10100L","status":"affected"},{"version":"10100L/G3","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":6.9,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"LOW","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"LOW","subIntegrityImpact":"LOW","subAvailabilityImpact":"LOW","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","baseScore":5.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-01-08T19:24:28.822286Z","id":"CVE-2019-25290","options":[{"exploitation":"poc"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"disclosure@vulncheck.com","type":"Secondary","description":[{"lang":"en","value":"CWE-918"}]}],"references":[{"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/172839","source":"disclosure@vulncheck.com"},{"url":"https://packetstormsecurity.com/files/155617","source":"disclosure@vulncheck.com"},{"url":"https://www.exploit-db.com/exploits/47764","source":"disclosure@vulncheck.com"},{"url":"https://www.inim.biz/","source":"disclosure@vulncheck.com"},{"url":"https://www.zeroscience.mk/en/vulnerabilities/ZSL-2019-5545.php","source":"disclosure@vulncheck.com"}]}},{"cve":{"id":"CVE-2024-51347","sourceIdentifier":"cve@mitre.org","published":"2026-03-25T14:16:29.097","lastModified":"2026-06-17T08:05:37.477","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"A buffer overflow vulnerability in the dgiot binary in LSC Smart Indoor IP Camera V7.6.32. The flaw exists in the handling of the Time Zone (TZ) parameter within the ONVIF configuration interface. The time zone (TZ) parameter does not have its length properly validated before being copied into a fixed-size buffer using the insecure strcpy function."},{"lang":"es","value":"Una vulnerabilidad de desbordamiento de búfer en el binario dgiot en LSC Smart Indoor IP Camera V7.6.32. La falla existe en el manejo del parámetro de Zona Horaria (TZ) dentro de la interfaz de configuración ONVIF. El parámetro de zona horaria (TZ) no tiene su longitud correctamente validada antes de ser copiado en un búfer de tamaño fijo utilizando la función strcpy insegura."}],"affected":[{"source":"cve@mitre.org","affectedData":[{"vendor":"n/a","product":"n/a","versions":[{"version":"n/a","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","baseScore":7.2,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.2,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-03-25T17:41:18.931017Z","id":"CVE-2024-51347","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-120"}]}],"references":[{"url":"https://github.com/victorGoeman/LSC-Indoor-Camera-Security-Research/blob/main/CVE-2024-51347.md","source":"cve@mitre.org"},{"url":"https://github.com/victorGoeman/LSC-Indoor-Camera-Security-Research/tree/main","source":"cve@mitre.org"},{"url":"https://github.com/victorGoeman/LSC-Indoor-Camera-Security-Research/blob/main/CVE-2024-51347.md","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}},{"cve":{"id":"CVE-2025-69986","sourceIdentifier":"cve@mitre.org","published":"2026-03-27T15:16:45.887","lastModified":"2026-06-17T10:00:56.993","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"A buffer overflow vulnerability exists in the ONVIF GetStreamUri function of LSC Indoor Camera V7.6.32. The application fails to validate the length of the Protocol parameter inside the Transport element. By sending a specially crafted SOAP request containing an oversized protocol string, an attacker can overflow the stack buffer, overwriting the return instruction pointer (RIP). This vulnerability allows for Denial of Service (DoS) via device crash or Remote Code Execution (RCE) in the context of the ONVIF service."}],"affected":[{"source":"cve@mitre.org","affectedData":[{"vendor":"n/a","product":"n/a","versions":[{"version":"n/a","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","baseScore":7.2,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.2,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-03-27T18:53:34.273183Z","id":"CVE-2025-69986","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-20"},{"lang":"en","value":"CWE-121"}]}],"references":[{"url":"https://github.com/victorGoeman/LSC-Indoor-Camera-Security-Research/blob/main/CVE-2025-69986.md","source":"cve@mitre.org"}]}},{"cve":{"id":"CVE-2026-6239","sourceIdentifier":"f23511db-6c3e-4e32-a477-6aa17d310630","published":"2026-06-06T00:16:40.977","lastModified":"2026-07-23T07:10:00.113","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"A stack‑based\nbuffer overflow vulnerability exists in Tapo C520WS v2 in the ONVIF CreateUsers service, where\nthe device fails to properly validate the number of XML user nodes during\nrequest processing. An authenticated attacker can send a specially crafted\nONVIF request containing an excessive number of user entries to trigger memory\ncorruption.\n\n\n\n\n\n\n\n\n\nSuccessful\nexploitation may cause the ONVIF management service to terminate unexpectedly,\nresulting in a denial‑of‑service (DoS) condition that disrupts device\nconfiguration and management functions."},{"lang":"es","value":"Una vulnerabilidad de desbordamiento de búfer basado en pila existe en Tapo C520WS v2 en el servicio ONVIF CreateUsers, donde el dispositivo no valida correctamente el número de nodos de usuario XML durante el procesamiento de solicitudes. Un atacante autenticado puede enviar una solicitud ONVIF especialmente diseñada que contiene un número excesivo de entradas de usuario para desencadenar la corrupción de memoria.\n\nLa explotación exitosa puede hacer que el servicio de gestión ONVIF termine inesperadamente, lo que resulta en una condición de denegación de servicio (DoS) que interrumpe las funciones de configuración y gestión del dispositivo."}],"affected":[{"source":"f23511db-6c3e-4e32-a477-6aa17d310630","affectedData":[{"vendor":"TP-Link Systems Inc.","product":"Tapo C520WS v2","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"1.2.6 Build 260528","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"f23511db-6c3e-4e32-a477-6aa17d310630","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:A/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":6.8,"baseSeverity":"MEDIUM","attackVector":"ADJACENT","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"HIGH","userInteraction":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-06-08T13:07:25.793532Z","id":"CVE-2026-6239","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"f23511db-6c3e-4e32-a477-6aa17d310630","type":"Secondary","description":[{"lang":"en","value":"CWE-121"}]}],"references":[{"url":"https://www.tp-link.com/en/support/download/tapo-c520ws/#Firmware-Release-Notes","source":"f23511db-6c3e-4e32-a477-6aa17d310630"},{"url":"https://www.tp-link.com/us/support/download/tapo-c520ws/#Firmware-Release-Notes","source":"f23511db-6c3e-4e32-a477-6aa17d310630"},{"url":"https://www.tp-link.com/us/support/faq/5120/","source":"f23511db-6c3e-4e32-a477-6aa17d310630"}]}},{"cve":{"id":"CVE-2026-6240","sourceIdentifier":"f23511db-6c3e-4e32-a477-6aa17d310630","published":"2026-06-06T00:16:41.103","lastModified":"2026-07-23T07:10:00.113","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"A stack-based buffer overflow vulnerability exists in Tapo C520WS v2 in the ONVIF DeleteUsers service, due to insufficient boundary checks when handling multiple user deletion parameters. An authenticated attacker can send a  crafted malicious request containing an excessive number of identifiers to overflow stack memory.\n\nSuccessful exploitation may result in a service crash or deadlock, leading to DoS affecting device management and monitoring functionality."},{"lang":"es","value":"Una vulnerabilidad de desbordamiento de búfer basado en pila existe en Tapo C520WS v2 en el servicio ONVIF DeleteUsers, debido a comprobaciones de límites insuficientes al manejar múltiples parámetros de eliminación de usuarios. Un atacante autenticado puede enviar una solicitud maliciosa manipulada que contiene un número excesivo de identificadores para desbordar la memoria de pila.\n\nLa explotación exitosa puede resultar en una caída del servicio o un interbloqueo, lo que lleva a DoS que afecta la funcionalidad de gestión y monitoreo del dispositivo."}],"affected":[{"source":"f23511db-6c3e-4e32-a477-6aa17d310630","affectedData":[{"vendor":"TP-Link Systems Inc.","product":"Tapo C520WS v2","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"1.2.6 Build 260528","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"f23511db-6c3e-4e32-a477-6aa17d310630","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:A/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":6.8,"baseSeverity":"MEDIUM","attackVector":"ADJACENT","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"HIGH","userInteraction":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-06-08T13:07:55.306567Z","id":"CVE-2026-6240","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"f23511db-6c3e-4e32-a477-6aa17d310630","type":"Secondary","description":[{"lang":"en","value":"CWE-121"}]}],"references":[{"url":"https://www.tp-link.com/en/support/download/tapo-c520ws/#Firmware-Release-Notes","source":"f23511db-6c3e-4e32-a477-6aa17d310630"},{"url":"https://www.tp-link.com/us/support/download/tapo-c520ws/#Firmware-Release-Notes","source":"f23511db-6c3e-4e32-a477-6aa17d310630"},{"url":"https://www.tp-link.com/us/support/faq/5120/","source":"f23511db-6c3e-4e32-a477-6aa17d310630"}]}},{"cve":{"id":"CVE-2026-6241","sourceIdentifier":"f23511db-6c3e-4e32-a477-6aa17d310630","published":"2026-06-06T00:16:41.230","lastModified":"2026-07-23T07:10:00.113","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"An authenticated format string vulnerability is present in the ONVIF AddScopes in Tapo C520WS v2, where user-controlled input is improperly passed to formatting functions without adequate sanitization. An attacker can inject format specifiers into ONVIF scope parameters to manipulate memory handling behavior.\n\nSuccessful exploitation may cause the ONVIF management service to crash, resulting in DoS condition that impacts normal device operation."},{"lang":"es","value":"Una vulnerabilidad de cadena de formato autenticada está presente en los AddScopes de ONVIF en Tapo C520WS v2, donde la entrada controlada por el usuario se pasa incorrectamente a funciones de formato sin una sanitización adecuada. Un atacante puede inyectar especificadores de formato en los parámetros de alcance de ONVIF para manipular el comportamiento de manejo de memoria. La explotación exitosa puede causar que el servicio de gestión de ONVIF falle, lo que resulta en una condición de DoS que impacta el funcionamiento normal del dispositivo."}],"affected":[{"source":"f23511db-6c3e-4e32-a477-6aa17d310630","affectedData":[{"vendor":"TP-Link Systems Inc.","product":"Tapo C520WS v2","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"1.2.6 Build 260528","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"f23511db-6c3e-4e32-a477-6aa17d310630","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:A/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":6.8,"baseSeverity":"MEDIUM","attackVector":"ADJACENT","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"HIGH","userInteraction":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-06-08T13:06:09.112804Z","id":"CVE-2026-6241","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"f23511db-6c3e-4e32-a477-6aa17d310630","type":"Secondary","description":[{"lang":"en","value":"CWE-134"}]}],"references":[{"url":"https://www.tp-link.com/en/support/download/tapo-c520ws/#Firmware-Release-Notes","source":"f23511db-6c3e-4e32-a477-6aa17d310630"},{"url":"https://www.tp-link.com/us/support/download/tapo-c520ws/#Firmware-Release-Notes","source":"f23511db-6c3e-4e32-a477-6aa17d310630"},{"url":"https://www.tp-link.com/us/support/faq/5120/","source":"f23511db-6c3e-4e32-a477-6aa17d310630"}]}},{"cve":{"id":"CVE-2026-6242","sourceIdentifier":"f23511db-6c3e-4e32-a477-6aa17d310630","published":"2026-06-06T00:16:41.347","lastModified":"2026-07-23T07:10:00.113","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"An authenticated format string vulnerability exists in the ONVIF Subscribe service in Tapo C520WS v2 due to improper handling of externally supplied parameters within formatting functions. An attacker may inject crafted format strings into event subscription requests or notification generation path to disrupt normal service execution.\n\nSuccessful exploitation may cause the event notification service to terminate unexpectedly, resulting in the loss of real-time alarm functionality and disruption of event notifications."},{"lang":"es","value":"Existe una vulnerabilidad de cadena de formato autenticada en el servicio ONVIF Subscribe en Tapo C520WS v2 debido al manejo inadecuado de parámetros suministrados externamente dentro de funciones de formato. Un atacante puede inyectar cadenas de formato manipuladas en solicitudes de suscripción de eventos o en la ruta de generación de notificaciones para interrumpir la ejecución normal del servicio. La explotación exitosa puede causar que el servicio de notificación de eventos termine inesperadamente, lo que resulta en la pérdida de la funcionalidad de alarma en tiempo real y la interrupción de las notificaciones de eventos."}],"affected":[{"source":"f23511db-6c3e-4e32-a477-6aa17d310630","affectedData":[{"vendor":"TP-Link Systems Inc.","product":"Tapo C520WS v2","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"1.2.6 Build 260528","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"f23511db-6c3e-4e32-a477-6aa17d310630","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:A/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":6.8,"baseSeverity":"MEDIUM","attackVector":"ADJACENT","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"HIGH","userInteraction":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-06-08T13:17:05.938418Z","id":"CVE-2026-6242","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"f23511db-6c3e-4e32-a477-6aa17d310630","type":"Secondary","description":[{"lang":"en","value":"CWE-134"}]}],"references":[{"url":"https://www.tp-link.com/en/support/download/tapo-c520ws/#Firmware-Release-Notes","source":"f23511db-6c3e-4e32-a477-6aa17d310630"},{"url":"https://www.tp-link.com/us/support/download/tapo-c520ws/#Firmware-Release-Notes","source":"f23511db-6c3e-4e32-a477-6aa17d310630"},{"url":"https://www.tp-link.com/us/support/faq/5120/","source":"f23511db-6c3e-4e32-a477-6aa17d310630"}]}},{"cve":{"id":"CVE-2026-6250","sourceIdentifier":"f23511db-6c3e-4e32-a477-6aa17d310630","published":"2026-06-11T22:16:57.870","lastModified":"2026-06-17T11:00:32.773","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"An\nauthenticated format string vulnerability exists in the ONVIF service of Tapo\nC110 v2 due to improper handling of user-controlled input.  Externally controlled data is interpreted as\na format string, which can be used to manipulate stack memory, including\ncontrol flow data such as return addresses.\n\n\n\n\n\nA remote\nauthenticated attacker may redirect execution flow to existing internal\nfunctions, triggering an unauthorized factory reset, leading to loss of\nconfiguration, deletion of stored credentials and service disruption."}],"affected":[{"source":"f23511db-6c3e-4e32-a477-6aa17d310630","affectedData":[{"vendor":"TP-Link Systems Inc.","product":"Tapo C110 v2","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"1.5.4 Build 260428","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"f23511db-6c3e-4e32-a477-6aa17d310630","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":7.0,"baseSeverity":"HIGH","attackVector":"ADJACENT","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H","baseScore":8.1,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":5.2}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-06-12T15:41:39.052599Z","id":"CVE-2026-6250","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"f23511db-6c3e-4e32-a477-6aa17d310630","type":"Secondary","description":[{"lang":"en","value":"CWE-134"}]},{"source":"nvd@nist.gov","type":"Primary","description":[{"lang":"en","value":"CWE-134"}]}],"configurations":[{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:tp-link:tapo_c110_firmware:*:*:*:*:*:*:*:*","versionEndExcluding":"1.5.4","matchCriteriaId":"08C9357E-A434-4B3F-97F9-2E51A33B60C4"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:tp-link:tapo_c110:2.0:*:*:*:*:*:*:*","matchCriteriaId":"4559D5F3-41A8-4D2D-9956-5B721709673F"}]}]}],"references":[{"url":"https://www.tp-link.com/en/support/download/tapo-c110/v2/#Firmware-Release-Notes","source":"f23511db-6c3e-4e32-a477-6aa17d310630","tags":["Release Notes"]},{"url":"https://www.tp-link.com/kr/support/download/tapo-c110/v2/#Firmware-Release-Notes","source":"f23511db-6c3e-4e32-a477-6aa17d310630","tags":["Release Notes"]},{"url":"https://www.tp-link.com/us/support/download/tapo-c110/v2/#Firmware-Release-Notes","source":"f23511db-6c3e-4e32-a477-6aa17d310630","tags":["Release Notes"]},{"url":"https://www.tp-link.com/us/support/faq/5128/","source":"f23511db-6c3e-4e32-a477-6aa17d310630","tags":["Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-57876","sourceIdentifier":"0df08a0e-a200-4957-9bb0-084f562506f9","published":"2026-06-26T08:16:24.560","lastModified":"2026-06-26T16:16:36.630","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"An unauthenticated\nout-of-bounds write vulnerability exists in onvif.cgi in GeoVision GV-LPC2011\nand GV-LPC2211 V1.12 and earlier. The vulnerability is caused by insufficient\nbounds checking when processing HTTP request body data. A remote attacker may\nexploit this vulnerability by sending a crafted request with excessive input,\ncausing memory corruption and resulting in a denial of service."}],"affected":[{"source":"0df08a0e-a200-4957-9bb0-084f562506f9","affectedData":[{"vendor":"GeoVision Inc.","product":"GV-LPCLPC2011/2211","defaultStatus":"unaffected","platforms":["Linux"],"versions":[{"version":"1.12","status":"affected"},{"version":"1.13","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"0df08a0e-a200-4957-9bb0-084f562506f9","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-06-26T15:39:48.481133Z","id":"CVE-2026-57876","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"0df08a0e-a200-4957-9bb0-084f562506f9","type":"Secondary","description":[{"lang":"en","value":"CWE-787"}]}],"references":[{"url":"https://www.geovision.com.tw/cyber_security.php","source":"0df08a0e-a200-4957-9bb0-084f562506f9"}]}}]}