CVE-2023-3704

EUVD-2023-44339
The vulnerability exists in CP-Plus DVR due to an improper input validation within the web-based management interface of the affected products. An unauthenticated remote attacker could exploit this vulnerability by sending specially crafted HTTP requests to the vulnerable device.

Successful exploitation of this vulnerability could allow the remote attacker to change system time of the targeted device.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
5.3 MEDIUM
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
CERT-InCNA
5.3 MEDIUM
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Base Score
CVSS 3.x
EPSS Score
Percentile: 27%
Affected Products (NVD)
VendorProductVersion
cpplusworldcp-uvr-1601e1-hc_firmware
𝑥
< 4.000.00at008.0.0.r20230302
cpplusworldcp-uvr-0401l1-4kh_firmware
𝑥
< 4.000.00at008.0.0.r20230302
cpplusworldcp-uvr-0401l1b-4kh_firmware
𝑥
< 4.000.00at008.0.0.r20230302
cpplusworldcp-uvr-0801f1-hc_firmware
𝑥
< 4.000.00at008.0.0.r20230302
cpplusworldcp-uvr-0801k1-h_firmware
𝑥
< 4.000.00at008.0.0.r20230302
cpplusworldcp-uvr-0801k1b-h_firmware
𝑥
< 4.000.00at008.0.0.r20230302
cpplusworldcp-uvr-0808k1-h_firmware
𝑥
< 4.000.00at008.0.0.r20230302
cpplusworldcp-uvr-1601e1-h_firmware
𝑥
< 4.000.00at008.0.0.r20230302
cpplusworldcp-uvr-1601e2-h_firmware
𝑥
< 4.000.00at008.0.0.r20230302
𝑥
= Vulnerable software versions
Common Weakness Enumeration
References
https://www.cert-in.org.in/s2cMainServlet?pageid=PUBVLNOTES01&VLCODE=CIVN-2023-0240
https://www.cert-in.org.in/s2cMainServlet?pageid=PUBVLNOTES01&VLCODE=CIVN-2023-0240