CVE-2023-3705

The vulnerability exists in CP-Plus NVR due to an improper input handling at the web-based management interface of the affected product. An unauthenticated remote attacker could exploit this vulnerability by sending specially crafted HTTP requests to the vulnerable device. Successful exploitation of this vulnerability could allow the remote attacker to obtain sensitive information on the targeted device.

CVSS v3 7.5 HIGH

7.5^/10

CVSS v3 : HIGH

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://www.cert-in.org.in/s2cMainServlet?pageid=PUBVLNOTES01&VLCODE=CIVN-2023-0239	Patch Third Party Advisory

Configurations

Configuration 1 (hide)

AND

cpe:2.3:o:cpplusworld:cp-vnr-3104_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:cpplusworld:cp-vnr-3104:-:*:*:*:*:*:*:*

Configuration 2 (hide)

AND

cpe:2.3:o:cpplusworld:cp-vnr-3108_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:cpplusworld:cp-vnr-3108:-:*:*:*:*:*:*:*

Configuration 3 (hide)

AND

cpe:2.3:o:cpplusworld:cp-vnr-3208_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:cpplusworld:cp-vnr-3208:-:*:*:*:*:*:*:*

History

No history.

Information

Published : 2023-08-24 08:15

Updated : 2023-08-31 00:37

NVD link : CVE-2023-3705

Mitre link : CVE-2023-3705

CVE.ORG link : CVE-2023-3705

JSON object : View

Products Affected

cpplusworld

cp-vnr-3104_firmware
cp-vnr-3208
cp-vnr-3208_firmware
cp-vnr-3104
cp-vnr-3108
cp-vnr-3108_firmware

CWE

NVD-CWE-noinfo CWE-200

Exposure of Sensitive Information to an Unauthorized Actor

{"id": "CVE-2023-3705", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 3.9}, {"type": "Secondary", "source": "vdisclose@cert-in.org.in", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 3.9}]}, "published": "2023-08-24T08:15:09.040", "references": [{"url": "https://www.cert-in.org.in/s2cMainServlet?pageid=PUBVLNOTES01&VLCODE=CIVN-2023-0239", "tags": ["Patch", "Third Party Advisory"], "source": "vdisclose@cert-in.org.in"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "NVD-CWE-noinfo"}]}, {"type": "Secondary", "source": "vdisclose@cert-in.org.in", "description": [{"lang": "en", "value": "CWE-200"}]}], "descriptions": [{"lang": "en", "value": "The vulnerability exists in CP-Plus NVR due to an improper input handling at the web-based management interface of the affected product. An unauthenticated remote attacker could exploit this vulnerability by sending specially crafted HTTP requests to the vulnerable device.\n\nSuccessful exploitation of this vulnerability could allow the remote attacker to obtain sensitive information on the targeted device.\n"}], "lastModified": "2023-08-31T00:37:27.440", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:cpplusworld:cp-vnr-3104_firmware:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "16BACB34-6325-4E52-A575-AEEDA3B2FE4F", "versionEndExcluding": "b3223p22c02424"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:cpplusworld:cp-vnr-3104:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "D1E31775-FFB5-40C3-9841-0C67D42E87C4"}], "operator": "OR"}], "operator": "AND"}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:cpplusworld:cp-vnr-3108_firmware:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "B1A6A2F4-6595-4DFC-A926-A2CB677E0CCD", "versionEndExcluding": "b3223p22c02424"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:cpplusworld:cp-vnr-3108:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "34F3AD8B-71BA-434A-A2EB-39C3292D4EC6"}], "operator": "OR"}], "operator": "AND"}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:cpplusworld:cp-vnr-3208_firmware:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "872BD1A6-87C4-4AC4-93E9-2CE82E0D4B74", "versionEndExcluding": "b3223p22c02424"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:cpplusworld:cp-vnr-3208:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "8269EEF4-930E-4205-A1AF-3D1D7114A6B5"}], "operator": "OR"}], "operator": "AND"}], "sourceIdentifier": "vdisclose@cert-in.org.in"}