CVE-2023-30467

Improper Authorization Vulnerability in Milesight Network Video Recorder (NVR)

State: Published
Severity: 7.5 High
Published: Apr 28, 2023
Updated: Jan 30, 2025
Reserved: Apr 10, 2023

Description

This vulnerability exists in Milesight 4K/H.265 Series NVR models (MS-Nxxxx-xxG, MS-Nxxxx-xxE, MS-Nxxxx-xxT, MS-Nxxxx-xxH and MS-Nxxxx-xxC), due to improper authorization at the Milesight NVR web-based management interface. A remote attacker could exploit this vulnerability by sending a specially crafted http requests on the targeted device.

Successful exploitation of this vulnerability could allow remote attacker to perform unauthorized activities on the targeted device.

Scores

CVSS	Score	Vector	Source
3.1	7.5 High	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H	CERT-In

Weaknesses

CWE-285 Improper Authorization

Affected Products

Product	Versions
NVR MS-Nxxxx-xxGMilesight	77.X to before 77.9.0.18-r2Affected
NVR MS-Nxxxx-xxEMilesight	75.X to before 75.9.0.18-r2Affected
NVR MS-Nxxxx-xxTMilesight	72.X to before 72.9.0.18-r2Affected
NVR MS-Nxxxx-xxHMilesight	71.X to before 71.9.0.18-r2Affected
NVR MS-Nxxxx-xxCMilesight	73.X to before 73.9.0.18-r2Affected

References

https://www.cert-in.org.in/s2cMainServlet?pageid=PUBVLNOTES01&VLCODE=CIVN-2023-0121

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.