Login Request a demo
High severity · published Apr 26, 2024
CVE-2023-6096
using a inappropriate encryption logic
7.4
CVSS
0.1%
EPSS
No
On KEV
Description
Vladimir Kononovich, a Security Researcher has found a flaw that using a inappropriate encryption logic on the DVR. firmware encryption is broken and allows to decrypt. The manufacturer has released patch firmware for the flaw, please refer to the manufacturer's report for details and workarounds.
CVSS vector
CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Local
Complexity
High
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.1% · higher than 1% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
HR
HRX-1620 · Hanwha Vision Co., Ltd.
3.05.62 and prior versions · source: vendor, CISA
AR
Arn-3250 · Hanwhavision
All versions, or not specified · source: CISA
HR
Hrx-1621 · Hanwhavision
All versions, or not specified · source: CISA
HR
Hrx-420 · Hanwhavision
All versions, or not specified · source: CISA
HR
Hrx-421 · Hanwhavision
All versions, or not specified · source: CISA
HR
Hrx-820 · Hanwhavision
All versions, or not specified · source: CISA
HR
Hrx-821 · Hanwhavision
All versions, or not specified · source: CISA
QR
Qrn-410 · Hanwhavision
All versions, or not specified · source: CISA
QR
Qrn-430s · Hanwhavision
All versions, or not specified · source: CISA
QR
Qrn-810 · Hanwhavision
All versions, or not specified · source: CISA
XR
Xrn-2010 · Hanwhavision
All versions, or not specified · source: CISA
XR
Xrn-2010a · Hanwhavision
All versions, or not specified · source: CISA
Affected product
HR
HRX-1620
Hanwha Vision Co., Ltd.
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2023-6096
CVE.org
https://www.cve.org/CVERecord?id=CVE-2023-6096
www.hanwhavision.com
https://www.hanwhavision.com/wp-content/uploads/2024/04/NVR-DVR-Vulnerability-Report-CVE-2023-6095-6096.pdf
More from HRX-1620
8.9
CVE-2023-6095
Remote Code Execution without authentication using memory overflow