CVE-2019-12223: hanwha-security srn-1673s_firmware

Vulnerability summary

CVE-2019-12223 is a high (CVSS 7.8) vulnerability in hanwha-security srn-1673s_firmware. EPSS estimates a 2.37% chance of exploitation in the next 30 days, higher than 83.5% of scored vulnerabilities. 1 public exploit is recorded.

Timeline

1. 05-09-2019
   PublishedVulnerability first disclosed.
2. 04-08-2024
   Last modifiedVulnerability information updated.

Description

An issue was discovered in NVR WebViewer on Hanwah Techwin SRN-472s 1.07_190502 devices, and other SRN-x devices before 2019-05-03. A system crash and reboot can be achieved by submitting a long username in excess of 117 characters. The username triggers a buffer overflow in the main process controlling operation of the DVR system, rendering services unavailable during the reboot operation. A repeated attack affects availability as long as the attacker has network access to the device.

• CWE-119Improper Restriction of Operations within the Bounds of a Memory BufferThe product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.