{"containers": {"cna": {"affected": [{"product": "Video Management Systems", "vendor": "Milesight", "versions": [{"lessThan": "40.7.0.79-r1", "status": "affected", "version": "VMS", "versionType": "custom"}]}], "credits": [{"lang": "en", "value": "This vulnerability is reported by Souvik Kandar and Arko Dhar from Redinent Innovations Engineering & Research Team, Karnataka, India"}], "datePublic": "2022-09-14T00:00:00", "descriptions": [{"lang": "en", "value": "This vulnerability exists in Milesight Video Management Systems (VMS), all firmware versions prior to 40.7.0.79-r1, due to improper input handling at camera\u2019s web-based management interface. A remote attacker could exploit this vulnerability by sending a specially crafted http request on the targeted network camera. Successful exploitation of this vulnerability could allow the attacker to cause a Denial of Service condition on the targeted device."}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}}], "problemTypes": [{"descriptions": [{"cweId": "CWE-20", "description": "CWE-20 Improper Input Validation", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"dateUpdated": "2022-09-15T14:38:17", "orgId": "66834db9-ab24-42b4-be80-296b2e40335c", "shortName": "CERT-In"}, "references": [{"tags": ["x_refsource_MISC"], "url": "https://www.cert-in.org.in/s2cMainServlet?pageid=PUBVLNOTES01&VLCODE=CIVN-2022-0352"}], "solutions": [{"lang": "en", "value": "Update Milesight VMS firmware to latest version\nhttps://drive.google.com/file/d/1D4I8M_R31CRaA8mZjFnWNgGjnQjtITzB/view?usp=sharing"}], "source": {"discovery": "UNKNOWN"}, "title": "Vulnerability in Milesight Video Management Systems (VMS)", "x_generator": {"engine": "Vulnogram 0.0.9"}, "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "vdisclose@cert-in.org.in", "DATE_PUBLIC": "2022-09-14T09:25:00.000Z", "ID": "CVE-2022-3001", "STATE": "PUBLIC", "TITLE": "Vulnerability in Milesight Video Management Systems (VMS)"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "Video Management Systems", "version": {"version_data": [{"version_affected": "<", "version_name": "VMS", "version_value": "40.7.0.79-r1"}]}}]}, "vendor_name": "Milesight"}]}}, "credit": [{"lang": "eng", "value": "This vulnerability is reported by Souvik Kandar and Arko Dhar from Redinent Innovations Engineering & Research Team, Karnataka, India"}], "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "This vulnerability exists in Milesight Video Management Systems (VMS), all firmware versions prior to 40.7.0.79-r1, due to improper input handling at camera\u2019s web-based management interface. A remote attacker could exploit this vulnerability by sending a specially crafted http request on the targeted network camera. Successful exploitation of this vulnerability could allow the attacker to cause a Denial of Service condition on the targeted device."}]}, "generator": {"engine": "Vulnogram 0.0.9"}, "impact": {"cvss": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "CWE-20 Improper Input Validation"}]}]}, "references": {"reference_data": [{"name": "https://www.cert-in.org.in/s2cMainServlet?pageid=PUBVLNOTES01&VLCODE=CIVN-2022-0352", "refsource": "MISC", "url": "https://www.cert-in.org.in/s2cMainServlet?pageid=PUBVLNOTES01&VLCODE=CIVN-2022-0352"}]}, "solution": [{"lang": "en", "value": "Update Milesight VMS firmware to latest version\nhttps://drive.google.com/file/d/1D4I8M_R31CRaA8mZjFnWNgGjnQjtITzB/view?usp=sharing"}], "source": {"discovery": "UNKNOWN"}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-03T00:52:59.889Z"}, "title": "CVE Program Container", "references": [{"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://www.cert-in.org.in/s2cMainServlet?pageid=PUBVLNOTES01&VLCODE=CIVN-2022-0352"}]}]}, "cveMetadata": {"assignerOrgId": "66834db9-ab24-42b4-be80-296b2e40335c", "assignerShortName": "CERT-In", "cveId": "CVE-2022-3001", "datePublished": "2022-09-15T14:38:17.410931Z", "dateReserved": "2022-08-26T00:00:00", "dateUpdated": "2024-09-16T17:47:40.718Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:h:milesight:video_management_systems:-:*:*:*:enterprise:*:*:*", "matchCriteriaId": "59426D14-93A6-492A-BF7F-29E6F03A05F6", "vulnerable": false}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:o:milesight:video_management_systems_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "44F7227E-E73F-4F33-BDF4-8DB49E7AAD97", "versionEndExcluding": "40.7.0.79", "vulnerable": true}, {"criteria": "cpe:2.3:o:milesight:video_management_systems_firmware:40.7.0.79:-:*:*:*:*:*:*", "matchCriteriaId": "AA621C44-CEF9-46DE-87BF-E33ABD8ECBC0", "vulnerable": true}], "negate": false, "operator": "OR"}], "operator": "AND"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "This vulnerability exists in Milesight Video Management Systems (VMS), all firmware versions prior to 40.7.0.79-r1, due to improper input handling at camera\u2019s web-based management interface. A remote attacker could exploit this vulnerability by sending a specially crafted http request on the targeted network camera. Successful exploitation of this vulnerability could allow the attacker to cause a Denial of Service condition on the targeted device."}, {"lang": "es", "value": "Esta vulnerabilidad se presenta en Milesight Video Management Systems (VMS), en todas las versiones de firmware anteriores a 40.7.0.79-r1, debido a un manejo inapropiado de las entradas en la interfaz de administraci\u00f3n basada en web de la c\u00e1mara. Un atacante remoto podr\u00eda explotar esta vulnerabilidad mediante el env\u00edo de una petici\u00f3n http especialmente dise\u00f1ada en la c\u00e1mara de red objetivo. Una explotaci\u00f3n con \u00e9xito de esta vulnerabilidad podr\u00eda permitir al atacante causar una condici\u00f3n de denegaci\u00f3n de servicio en el dispositivo objetivo"}], "id": "CVE-2022-3001", "lastModified": "2022-09-19T19:08:04.817", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "vdisclose@cert-in.org.in", "type": "Secondary"}]}, "published": "2022-09-15T15:15:10.400", "references": [{"source": "vdisclose@cert-in.org.in", "tags": ["Third Party Advisory"], "url": "https://www.cert-in.org.in/s2cMainServlet?pageid=PUBVLNOTES01&VLCODE=CIVN-2022-0352"}], "sourceIdentifier": "vdisclose@cert-in.org.in", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-20"}], "source": "nvd@nist.gov", "type": "Primary"}, {"description": [{"lang": "en", "value": "CWE-20"}], "source": "vdisclose@cert-in.org.in", "type": "Secondary"}]}

{}