CVE-2019-12223
High
Description
An issue was discovered in NVR WebViewer on Hanwah Techwin SRN-472s 1.07_190502 devices, and other SRN-x devices before 2019-05-03. A system crash and reboot can be achieved by submitting a long username in excess of 117 characters. The username triggers a buffer overflow in the main process controlling operation of the DVR system, rendering services unavailable during the reboot operation. A repeated attack affects availability as long as the attacker has network access to the device.
SeverityHigh
CVSS7.5
Exploit probability—
ProductHanwha-security Srn-472s Firmware
PublishedSep 5, 2019
First seenSep 5, 2019
How to fix
Update
- hanwha-security srn-873s_firmware2019-05-03 or later
- hanwha-security srn-1673s_firmware2019-05-03 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| hanwha-security srn-472s_firmware | 1.07_190502 | — |
| hanwha-security srn-873s_firmware | v < 2019-05-03 | 2019-05-03 |
| hanwha-security srn-1673s_firmware | v < 2019-05-03 | 2019-05-03 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.