CVE-2022-45460
48Vexday Risk Score
No sign of exploitation. It has a public proof of concept.
ssvc Attendcvss 9.8epss 5.7%
from disclosure to weapon674 days
Published on NVDMar 28
1st PoC+674d
exploitation probability
5.7%top 7% of all CVEs
observed exploitation
nono source reports it
1 public exploit(s)
Multiple Xiongmai NVR devices, including MBD6304T V4.02.R11.00000117.10001.131900.00000 and NBD6808T-PL V4.02.R11.C7431119.12001.130000.00000, allow an unauthenticated and remote user to exploit a stack-based buffer overflow and crash the web server, resulting in a system reboot. An unauthenticated and remote attacker can execute arbitrary code by sending a crafted HTTP request that triggers the overflow condition via a long URI passed to a sprintf call. NOTE: this is different than CVE-2018-10088, but this may overlap CVE-2017-16725.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected products
n/a · n/apublic PoCs found — 1
githubgithub.com/born0monday/CVE-2022-45460★ 6⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.