Sign-up

ID

VAR-201411-0522


CVE

CVE-2014-4878


TITLE

Hikvision DVR DS-7204 Remote Buffer Overflow Vulnerability (CNVD-2014-08566)

Trust: 0.6

sources: CNVD: CNVD-2014-08566

DESCRIPTION

The Hikvision DVR is a hard disk recorder. Hikvision DVR DS-7204 has a remote buffer overflow vulnerability because it fails to adequately check the boundaries of the user-supplied data. An attacker could exploit this vulnerability to execute arbitrary code in the context of an affected device. Failed exploit attempts may result in a denial-of-service condition. Hikvision DVR DS-7204 running firmware 2.2.10 is vulnerable; other devices may also be affected. R7-2014-18: Buffer Overflow in Hikvision RTSP Request Body Handling (CVE-2014-4878)

Trust: 0.9

sources: CNVD: CNVD-2014-08566 // BID: 71302 // VULMON: CVE-2014-4878

IOT TAXONOMY

category:['IoT', 'Network device']sub_category: -

Trust: 0.6

sources: CNVD: CNVD-2014-08566

AFFECTED PRODUCTS

vendor:hikvisionmodel:dvr ds-7204scope:eqversion:2.2.10

Trust: 0.6

vendor:hikvisionmodel:digital technology ds-7204scope:eqversion:2.2.10

Trust: 0.3

sources: CNVD: CNVD-2014-08566 // BID: 71302

CVSS

SEVERITY

CVSSV2

CVSSV3

CNVD: CNVD-2014-08566
value: HIGH

Trust: 0.6

CNVD: CNVD-2014-08566
severity: HIGH
baseScore: 7.5
vectorString: AV:N/AC:L/AU:N/C:P/I:P/A:P
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: PARTIAL
availabilityImpact: PARTIAL
exploitabilityScore: 10.0
impactScore: 6.4
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.6

sources: CNVD: CNVD-2014-08566

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-201412-017

TYPE

buffer overflow

Trust: 0.6

sources: CNNVD: CNNVD-201412-017

PATCH

title:Patch for Hikvision DVR DS-7204 Remote Buffer Overflow Vulnerability (CNVD-2014-08566)url:https://www.cnvd.org.cn/patchinfo/show/54369

Trust: 0.6

title:Vulnerabilitiesurl:https://github.com/wrlu/vulnerabilities

Trust: 0.1

title:Vulnerabilitiesurl:https://github.com/wrlu/poc-and-exp-of-vulnerabilities

Trust: 0.1

title:poc--expurl:https://github.com/hactf/poc--exp

Trust: 0.1

title:poc-expurl:https://github.com/msr00t/poc-exp

Trust: 0.1

title:Threatposturl:https://threatpost.com/remote-code-execution-in-popular-hikvision-surveillance-dvr/109552/

Trust: 0.1

sources: CNVD: CNVD-2014-08566 // VULMON: CVE-2014-4878

EXTERNAL IDS

db:NVDid:CVE-2014-4878

Trust: 1.6

db:BIDid:71302

Trust: 1.5

db:CNVDid:CNVD-2014-08566

Trust: 0.6

db:CNNVDid:CNNVD-201412-017

Trust: 0.6

db:VULMONid:CVE-2014-4878

Trust: 0.1

sources: CNVD: CNVD-2014-08566 // VULMON: CVE-2014-4878 // BID: 71302 // CNNVD: CNNVD-201412-017

REFERENCES

url:http://www.securityfocus.com/bid/71302

Trust: 1.2

url:http://www.hikvision.com/en/us/products_show.asp?id=4258

Trust: 0.3

url:https://community.rapid7.com/community/metasploit/blog/2014/11/19/r7-2014-18-hikvision-dvr-devices--multiple-vulnerabilities

Trust: 0.3

url:https://www.rapid7.com/db/vulnerabilities/r7-2014-18-cve-2014-4878

Trust: 0.1

url:https://threatpost.com/remote-code-execution-in-popular-hikvision-surveillance-dvr/109552/

Trust: 0.1

url:https://github.com/wrlu/vulnerabilities

Trust: 0.1

sources: CNVD: CNVD-2014-08566 // VULMON: CVE-2014-4878 // BID: 71302 // CNNVD: CNNVD-201412-017

CREDITS

Mark Schloesser

Trust: 0.9

sources: BID: 71302 // CNNVD: CNNVD-201412-017

SOURCES

db:CNVDid:CNVD-2014-08566
db:VULMONid:CVE-2014-4878
db:BIDid:71302
db:CNNVDid:CNNVD-201412-017

LAST UPDATE DATE

2022-05-04T09:12:14.607000+00:00


SOURCES UPDATE DATE

db:CNVDid:CNVD-2014-08566date:2015-01-22T00:00:00
db:BIDid:71302date:2014-11-19T00:00:00
db:CNNVDid:CNNVD-201412-017date:2014-12-02T00:00:00

SOURCES RELEASE DATE

db:CNVDid:CNVD-2014-08566date:2014-11-28T00:00:00
db:BIDid:71302date:2014-11-19T00:00:00
db:CNNVDid:CNNVD-201412-017date:2014-11-19T00:00:00