Medium severity · published Dec 24, 2024
CVE-2024-41882
Stack based buffer overflow
6.9
CVSS
0.8%
EPSS
No
On KEV
Description
Team ENVY, a Security Research TEAM has found a flaw that allows for a remote code execution on the NVR. An attacker can cause a stack overflow by entering large data into URL parameters, which will result in a system reboot. The manufacturer has released patch firmware for the flaw, please refer to the manufacturer's report for details and workarounds.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.8% · higher than 58% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
XR
XRN-420S · Hanwha Vision Co., Ltd.
5.01.62 and prior versions · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-41882
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-41882
www.hanwhavision.com
https://www.hanwhavision.com/wp-content/uploads/2024/12/NVR-Vulnerability-Report-CVE-2024-4188241887.pdf
More from XRN-420S
6.9
CVE-2024-41883
Null Pointer Dereference
6.9
CVE-2024-41884
Null Pointer Dereference
6.9
CVE-2024-41886
Improper Input Validation
5.6
CVE-2024-41885
Hardcoding sensitive information
5.1
CVE-2024-41887
Arbitrary File Overwrite
