NLIn der Originalsprache angezeigt — eine vollständige Übersetzung ist für eine zukünftige Version geplant.
Kwetsbaarheden ontdekt in Kiloview P1 4G Video Encoder en P2 4G Video Encoder
Er zijn kwetsbaarheden ontdekt in Kiloview P1 en P2. Kiloview P1 en P2 zijn hardware-oplossingen om beeldinformatie in HDMI-formaat te kunnen streamen. De firmware van deze systemen bevat een aantal ernstige kwetsbaarheden, waardoor een kwaadwillende aanvallen kan uitvoeren die kunnen leiden tot de volgende categorieën schade: • Cross-Site-Scripting (XSS) • Omzeilen van authenticatie • Denial-of-Service (DoS) • Manipulatie van gegevens • (Remote) code execution (Administrator/Root rechten) • Toegang tot gevoelige gegevens
beschreibt (10)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2023-41928US | —OT erhöht | — | ||
The device is observed to accept deprecated TLS protocols, increasing the risk of cryptographic weaknesses. | ||||
| CVE-2023-41927US | —OT erhöht | — | ||
The server supports at least one cipher suite which is on the NCSC-NL list of cipher suites to be phased out, increasing the risk of cryptographic weaknesses. | ||||
| CVE-2023-41926US | — | — | ||
The webserver utilizes basic authentication for its user login to the configuration interface. As encryption is disabled on port 80, it enables potential eavesdropping on user traf… | ||||
| CVE-2023-41923US | — | — | ||
The user management section of the web application permits the creation of user accounts with excessively weak passwords, including single-character passwords. | ||||
| CVE-2023-41922US | medium5.4 | — | ||
A 'Cross-site Scripting' (XSS) vulnerability, characterized by improper input neutralization during web page generation, has been discovered. This vulnerability allows for Stored X… | ||||
| CVE-2023-41921US | —OT erhöht | — | ||
A vulnerability allows attackers to download source code or an executable from a remote location and execute the code without sufficiently verifying the origin and integrity of the… | ||||
| CVE-2023-41920US | — | — | ||
The vulnerability allows attackers access to the root account without having to authenticate. Specifically, if the device is configured with the IP address of 10.10.10.10, the root… | ||||
| CVE-2023-41919US | critical9.8OT erhöht | — | ||
Hardcoded credentials are discovered within the application's source code, creating a potential security risk for unauthorized access. | ||||
| CVE-2023-41918US | —OT erhöht | — | ||
A vulnerability allows unauthorized access to functionality inadequately constrained by ACLs. Attackers may exploit this to unauthenticated execute commands potentially leading to… | ||||
| CVE-2023-41917US | — | — | ||
Inadequate input validation exposes the system to potential remote code execution (RCE) risks. Attackers can exploit this vulnerability by appending shell commands to the Speed-Mea… | ||||
Referenzen
Externe Belege — Patches, Meldungen, Analysen.
- Reference - ncscclearexternal
Advisories wie diese benennen die exponierten Produkte, die Angreifer auf Ihrer Angriffsfläche ins Visier nehmen. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan