CVE-2022-43400

A flaw in Siveillance Video Mobile Server allows attackers to log in without valid credentials by exploiting how the system handles Active Directory administrator accounts. This could let anyone access the application remotely without authorization.

The vulnerability exists in the authentication mechanism for Active Directory accounts assigned to the Administrators group; an unauthenticated remote attacker can bypass login requirements through improper handling of these privileged accounts. The attack requires network access to the mobile server but no prior credentials, resulting in complete unauthorized access to the application.