CVE-2021-41506

Katalog CVE

CVSS 9.8 · Critical EPSS 2,3%

Kerentanan Improper Authentication pada xiongmaitech ahb7008t-mh-v2 firmware, xiongmaitech ahb7804r-els firmware +6 lainnya. Skor CVSS 3.1 9.8 (Critical) menurut NVD.

Deskripsi (NVD)

Xiaongmai AHB7008T-MH-V2, AHB7804R-ELS, AHB7804R-MH-V2, AHB7808R-MS-V2, AHB7808R-MS, AHB7808T-MS-V2, AHB7804R-LMS, HI3518_50H10L_S39 V4.02.R11.7601.Nat.Onvif.20170420, V4.02.R11.Nat.Onvif.20160422, V4.02.R11.7601.Nat.Onvif.20170424, V4.02.R11.Nat.Onvif.20170327, V4.02.R11.Nat.Onvif.20161205, V4.02.R11.Nat.20170301, V4.02.R12.Nat.OnvifS.20170727 is affected by a backdoor in the macGuarder and dvrHelper binaries of DVR/NVR/IP camera firmware due to static root account credentials in the system.

Rincian

Terbit di NVD

30 Juni 2022

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

9.8 (Critical), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-287: Improper Authentication

EPSS (30 hari)

2,3% peluang dieksploitasi; lebih tinggi dari 83,0% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://www.xiongmaitech.com/en/index.php/news/info/12/68 advisory vendor
• https://github.com/Snawoot/hisilicon-dvr-telnet advisory pihak ketiga
• https://github.com/tothi/hs-dvr-telnet advisory pihak ketiga
• https://habr.com/en/post/486856/ exploit · advisory pihak ketiga