HIGH🇵🇱 Wersja polska

CVE-2022-45045

CVSS 8.8v3.1pub. 2022-12-01upd. 2025-04-24

Multiple Xiongmai NVR devices, including MBD6304T V4.02.R11.00000117.10001.131900.00000 and NBD6808T-PL V4.02.R11.C7431119.12001.130000.00000, allow authenticated users to execute arbitrary commands as root, as exploited in the wild starting in approximately 2019. A remote and authenticated attacker, possibly using the default admin:tlJwpbo6 credentials, can connect to port 34567 and execute arbitrary operating system commands via a crafted JSON file during an upgrade request. Since at least 2021, Xiongmai has applied patches to prevent attackers from using this mechanism to execute telnetd.

CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

  • Xiongmaitech Mbd6304t

    HW
    Xiongmaitech
    all versions

  • Xiongmaitech Mbd6304t Firmware

    OS
    Xiongmaitech
    4.02.r11.00000117.10001.131900.00000

  • Xiongmaitech Nbd6808t Pl

    HW
    Xiongmaitech
    all versions

  • Xiongmaitech Nbd6808t Pl Firmware

    OS
    Xiongmaitech
    4.02.r11.c7431119.12001.130000.00000

  • Xiongmaitech Nbd7004t P

    HW
    Xiongmaitech
    all versions

  • Xiongmaitech Nbd7004t P Firmware

    OS
    Xiongmaitech
    all versions

  • Xiongmaitech Nbd7008t P

    HW
    Xiongmaitech
    all versions

  • Xiongmaitech Nbd7008t P Firmware

    OS
    Xiongmaitech
    all versions

  • Xiongmaitech Nbd7016t F V2

    HW
    Xiongmaitech
    all versions

  • Xiongmaitech Nbd7016t F V2 Firmware

    OS
    Xiongmaitech
    all versions

  • Xiongmaitech Nbd7024h P

    HW
    Xiongmaitech
    all versions

  • Xiongmaitech Nbd7024h P Firmware

    OS
    Xiongmaitech
    all versions

  • Xiongmaitech Nbd7024t P

    HW
    Xiongmaitech
    all versions

  • Xiongmaitech Nbd7024t P Firmware

    OS
    Xiongmaitech
    all versions

  • Xiongmaitech Nbd7804r F\(ep\)

    HW
    Xiongmaitech
    all versions

  • Xiongmaitech Nbd7804r F\(ep\) Firmware

    OS
    Xiongmaitech
    all versions

  • Xiongmaitech Nbd7804r F\(hdmi\)

    HW
    Xiongmaitech
    all versions

  • Xiongmaitech Nbd7804r F\(hdmi\) Firmware

    OS
    Xiongmaitech
    all versions

  • Xiongmaitech Nbd7804r Fw

    HW
    Xiongmaitech
    all versions

  • Xiongmaitech Nbd7804r Fw Firmware

    OS
    Xiongmaitech
    all versions

  • Xiongmaitech Nbd7804t Pl

    HW
    Xiongmaitech
    all versions

  • Xiongmaitech Nbd7804t Pl Firmware

    OS
    Xiongmaitech
    all versions

  • Xiongmaitech Nbd7808r Pl\(ep\)

    HW
    Xiongmaitech
    all versions

  • Xiongmaitech Nbd7808r Pl\(ep\) Firmware

    OS
    Xiongmaitech
    all versions

  • Xiongmaitech Nbd7808r Pl\(hdmi\)

    HW
    Xiongmaitech
    all versions

  • Xiongmaitech Nbd7808r Pl\(hdmi\) Firmware

    OS
    Xiongmaitech
    all versions

  • Xiongmaitech Nbd7808t Pl

    HW
    Xiongmaitech
    all versions

  • Xiongmaitech Nbd7808t Pl Firmware

    OS
    Xiongmaitech
    all versions

  • Xiongmaitech Nbd7904r Fs

    HW
    Xiongmaitech
    all versions

  • Xiongmaitech Nbd7904r Fs Firmware

    OS
    Xiongmaitech
    all versions
🔵
CHECK WITH VENDOR
No clear patch data available. Check vendor references.
Tags
Command Injection
CWE
References

Related vulnerabilities

CVE-2022-45460CRITICAL9.8PL ✓same product

Stack-based buffer overflow w urządzeniach NVR Xiongmai — RCE bez uwierzytelnienia

CVE-2022-26259HIGH7.8same product

A buffer over flow in Xiongmai DVR devices NBD80X16S-KL, NBD80X09S-KL, NBD80X08S-KL, NBD80X09RA-KL, AHB80X04R-...

CVE-2025-65856CRITICAL9.8PL ✓same vendor

Authentication bypass w kamerach IP Xiongmai XM530 — dostęp bez uwierzytelnienia

CVE-2021-41506CRITICAL9.8PL ✓same vendor

Backdoor w firmware urządzeń Xiongmai — statyczne dane konta root

CVE-2020-22253CRITICAL9.8PL ✓same vendor

Xiongmai Technology: otwarty port 9530 umożliwia nieautoryzowany dostęp Telnet