CVE-2017-16725

critical-risk
Published 2017-12-20

A Stack-based Buffer Overflow issue was discovered in Xiongmai Technology IP Cameras and DVRs using the NetSurveillance Web interface. The stack-based buffer overflow vulnerability has been identified, which may allow an attacker to execute code remotely or crash the device. After rebooting, the device restores itself to a more vulnerable state in which Telnet is accessible.

Do I need to act?

~
8.5% chance of exploitation in next 30 days
EPSS score — moderate exploit probability
-
Not on CISA KEV list
No confirmed active exploitation reported to CISA
?
Patch status unknown
Check vendor advisories for fix availability and mitigation guidance
9
CVSS 9.8/10 Critical
NETWORK / LOW complexity

Affected Products (20)

Ahb7008T-Mh-V2 Firmware
Ahb7016T-Lm-V2 Firmware
Ahb7008T4-H-V2 Firmware
Ahb7008T-H-V2 Firmware
Ahb7008T4-H-V2
Ahb7032F8-Lm-V2 Firmware
Ahb7032F4-Lm-V2 Firmware
Ahb7016T-Lm-V3 Firmware
Ahb7008T-Lm-V3 Firmware
Ahb7008T-Gl-V4 Firmware
Ahb7016F8-Gl-V4 Firmware
Ahb7804R-Lms-V3 Firmware
Ahb7008F8-G-V4 Firmware
Ahb7032F4-Lm-V3 Firmware
Ahb7032F8-Gs-V3 Firmware
Ahb7032F4-Gs-V3 Firmware
Ahb7004T-Lme-V3 Firmware
Ahb7808R-Mh-V3 Firmware
Ahb7804R-Mh-V3 Firmware
Ipg-52H10Pl-P Firmware

Affected Vendors

Xiongmaitech

References (4)

Third Party Advisory http://www.securityfocus.com/bid/102125
Third Party Advisory https://ics-cert.us-cert.gov/advisories/ICSA-17-341-01
Third Party Advisory http://www.securityfocus.com/bid/102125
Third Party Advisory https://ics-cert.us-cert.gov/advisories/ICSA-17-341-01
74
/ 100
critical-risk
Severity 32/34 · Critical
Exploitability 10/34 · Low
Exposure 32/34 · Critical