« Volver al listado

CVE-2023-3705

Estado: ModificadaAlta (7.5)—

The vulnerability exists in CP-Plus NVR due to an improper input handling at the web-based management interface of the affected product. An unauthenticated remote attacker could exploit this vulnerability by sending specially crafted HTTP requests to the vulnerable device.

Successful exploitation of this vulnerability could allow the remote attacker to obtain sensitive information on the targeted device.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (3)

Cpplusworld — Cp-vnr-3104 FirmwareCpplusworld — Cp-vnr-3108 FirmwareCpplusworld — Cp-vnr-3208 Firmware

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2023-3705",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2023-3705",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2024-10-02T20:26:55.238727Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "vdisclose@cert-in.org.in",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 7.5,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 3.6,
        "exploitabilityScore": 3.9
      },
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 7.5,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 3.6,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "vdisclose@cert-in.org.in",
      "affectedData": [
        {
          "vendor": "Aditya Infotech Limited ",
          "product": "CP-VNR-3104, CP-VNR-3108, CP-VNR-3208",
          "versions": [
            {
              "status": "affected",
              "version": "0",
              "lessThan": "B3223P22C02424",
              "versionType": "custom"
            }
          ],
          "defaultStatus": "unaffected"
        }
      ]
    },
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "affectedData": [
        {
          "cpes": [
            "cpe:2.3:a:aditya_infotech_limited:cp-vnr-3104:*:*:*:*:*:*:*:*"
          ],
          "vendor": "aditya_infotech_limited",
          "product": "cp-vnr-3104",
          "versions": [
            {
              "status": "affected",
              "version": "0",
              "lessThan": "b3223P22C02424",
              "versionType": "custom"
            }
          ],
          "defaultStatus": "unknown"
        },
        {
          "cpes": [
            "cpe:2.3:a:aditya_infotech_limited:cp-vnr-3108:*:*:*:*:*:*:*:*"
          ],
          "vendor": "aditya_infotech_limited",
          "product": "cp-vnr-3108",
          "versions": [
            {
              "status": "affected",
              "version": "0",
              "lessThan": "b3223P22C02424",
              "versionType": "custom"
            }
          ],
          "defaultStatus": "unknown"
        },
        {
          "cpes": [
            "cpe:2.3:a:aditya_infotech_limited:cp-vnr-3208:*:*:*:*:*:*:*:*"
          ],
          "vendor": "aditya_infotech_limited",
          "product": "cp-vnr-3208",
          "versions": [
            {
              "status": "affected",
              "version": "0",
              "lessThan": "b3223P22C02424",
              "versionType": "custom"
            }
          ],
          "defaultStatus": "unknown"
        }
      ]
    }
  ],
  "published": "2023-08-24T08:15:09.040",
  "references": [
    {
      "url": "https://www.cert-in.org.in/s2cMainServlet?pageid=PUBVLNOTES01&VLCODE=CIVN-2023-0239",
      "tags": [
        "Patch",
        "Third Party Advisory"
      ],
      "source": "vdisclose@cert-in.org.in"
    },
    {
      "url": "https://www.cert-in.org.in/s2cMainServlet?pageid=PUBVLNOTES01&VLCODE=CIVN-2023-0239",
      "tags": [
        "Patch",
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "vdisclose@cert-in.org.in",
      "description": [
        {
          "lang": "en",
          "value": "CWE-200"
        }
      ]
    },
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "NVD-CWE-noinfo"
        }
      ]
    },
    {
      "type": "Secondary",
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "description": [
        {
          "lang": "en",
          "value": "CWE-20"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "The vulnerability exists in CP-Plus NVR due to an improper input handling at the web-based management interface of the affected product. An unauthenticated remote attacker could exploit this vulnerability by sending specially crafted HTTP requests to the vulnerable device.\n\nSuccessful exploitation of this vulnerability could allow the remote attacker to obtain sensitive information on the targeted device.\n"
    }
  ],
  "lastModified": "2026-06-17T06:14:40.453",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:cpplusworld:cp-vnr-3104_firmware:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "16BACB34-6325-4E52-A575-AEEDA3B2FE4F",
              "versionEndExcluding": "b3223p22c02424"
            }
          ],
          "operator": "OR"
        },
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:cpplusworld:cp-vnr-3104:-:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "D1E31775-FFB5-40C3-9841-0C67D42E87C4"
            }
          ],
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:cpplusworld:cp-vnr-3108_firmware:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "B1A6A2F4-6595-4DFC-A926-A2CB677E0CCD",
              "versionEndExcluding": "b3223p22c02424"
            }
          ],
          "operator": "OR"
        },
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:cpplusworld:cp-vnr-3108:-:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "34F3AD8B-71BA-434A-A2EB-39C3292D4EC6"
            }
          ],
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:cpplusworld:cp-vnr-3208_firmware:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "872BD1A6-87C4-4AC4-93E9-2CE82E0D4B74",
              "versionEndExcluding": "b3223p22c02424"
            }
          ],
          "operator": "OR"
        },
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:cpplusworld:cp-vnr-3208:-:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "8269EEF4-930E-4205-A1AF-3D1D7114A6B5"
            }
          ],
          "operator": "OR"
        }
      ],
      "operator": "AND"
    }
  ],
  "sourceIdentifier": "vdisclose@cert-in.org.in"
}