CVE-2022-45460
9.8
CRITICAL · CVSS 3.1 · EPSS 5.7% (pctl 93)
In your normal cycle
Critical by CVSS (9.8), but no sign of active exploitation.
Description
Multiple Xiongmai NVR devices, including MBD6304T V4.02.R11.00000117.10001.131900.00000 and NBD6808T-PL V4.02.R11.C7431119.12001.130000.00000, allow an unauthenticated and remote user to exploit a stack-based buffer overflow and crash the web server, resulting in a system reboot. An unauthenticated and remote attacker can execute arbitrary code by sending a crafted HTTP request that triggers the overflow condition via a long URI passed to a sprintf call. NOTE: this is different than CVE-2018-10088, but this may overlap CVE-2017-16725.
Scoring
| CVSS | 9.8 (CRITICAL, v3.1) |
|---|---|
| Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| EPSS | 5.67% — more likely to be exploited than 93% of all CVEs |
| Weakness | CWE-787 |
| On CISA KEV | no |
| Public exploit | none known |
| Published | 2023-03-28 |
| Last modified | 2026-06-17 |
Affected (4)
| Vendor | Product |
|---|---|
| xiongmaitech | mbd6304t |
| xiongmaitech | mbd6304t firmware |
| xiongmaitech | nbd6808t-pl |
| xiongmaitech | nbd6808t-pl firmware |
References
→ the Explorer · watch your stack · NVD