CVE-2023-3638 - OpenCVE

In GeoVision GV-ADR2701 cameras, an attacker could edit the login response to access the web application.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

Vendors	Products
Geovision	Gv-adr2701 Gv-adr2701 Firmware

Configuration 1 [-]

AND

cpe:2.3:o:geovision:gv-adr2701_firmware:1.00_2017_12_15:*:*:*:*:*:*:*

cpe:2.3:h:geovision:gv-adr2701:-:*:*:*:*:*:*:*

No data.

References

Link	Providers
https://www.cisa.gov/news-events/ics-advisories/icsa-23-199-05

History

No history.

MITRE

Status: PUBLISHED

Assigner: icscert

Published: 2023-07-19T14:22:13.198Z

Updated: 2024-08-02T07:01:57.287Z

Reserved: 2023-07-12T13:56:15.455Z

Link: CVE-2023-3638

Vulnrichment

No data.

NVD

Status : Analyzed

Published: 2023-07-19T15:15:11.257

Modified: 2023-07-28T14:17:11.180

Link: CVE-2023-3638

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2023-3638", "assignerOrgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6", "state": "PUBLISHED", "assignerShortName": "icscert", "dateReserved": "2023-07-12T13:56:15.455Z", "datePublished": "2023-07-19T14:22:13.198Z", "dateUpdated": "2024-08-02T07:01:57.287Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "GV-ADR2701", "vendor": "GeoVision ", "versions": [{"status": "affected", "version": "1.00_2017_12_15"}]}], "datePublic": "2023-07-18T14:19:00.000Z", "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "\nIn GeoVision GV-ADR2701 cameras, an attacker could edit the login response to access the web application.\n\n"}], "value": "In GeoVision GV-ADR2701 cameras, an attacker could edit the login response to access the web application.\n\n"}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-287", "description": "CWE-287: Improper Authentication", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6", "shortName": "icscert", "dateUpdated": "2023-07-19T14:22:13.198Z"}, "references": [{"url": "https://www.cisa.gov/news-events/ics-advisories/icsa-23-199-05"}], "solutions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "\nGeoVision recommends that users of these devices upgrade to newer models\n with the latest firmware update which they have verified are not \nvulnerable to this issue such as TDR2704, TDR2702, or TDR2700. \nAlternatively, users could restrict connection of these cameras to \nclosed local area networks isolated from internet connection.\n\n<br>"}], "value": "GeoVision recommends that users of these devices upgrade to newer models\n with the latest firmware update which they have verified are not \nvulnerable to this issue such as TDR2704, TDR2702, or TDR2700. \nAlternatively, users could restrict connection of these cameras to \nclosed local area networks isolated from internet connection.\n\n\n"}], "source": {"discovery": "UNKNOWN"}, "title": "GeoVision GV-ADR2701 Improper Authentication", "x_generator": {"engine": "Vulnogram 0.1.0-dev"}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T07:01:57.287Z"}, "title": "CVE Program Container", "references": [{"url": "https://www.cisa.gov/news-events/ics-advisories/icsa-23-199-05", "tags": ["x_transferred"]}]}]}}