CVE-2018-10734

moderate-risk
Published 2018-05-08

KONGTOP DVR devices A303, A403, D303, D305, and D403 contain a backdoor that prints the login password via a Print_Password function call in certain circumstances.

Do I need to act?

-
0.39% chance of exploitation
EPSS score — low exploit probability
-
Not on CISA KEV list
No confirmed active exploitation reported to CISA
?
Patch status unknown
Check vendor advisories for fix availability and mitigation guidance
9
CVSS 9.8/10 Critical
NETWORK / LOW complexity

Affected Products (5)

D303 Firmware
D305 Firmware
D403 Firmware
A303 Firmware
A403 Firmware

Affected Vendors

Kongtop

References (6)

Third Party Advisory https://github.com/hucmosin/MyBook/blob/master/KONGTOP_DVR_devices_vulnerability...
Third Party Advisory https://github.com/hucmosin/MyBook/blob/master/fu/DVR.pdf
Exploit https://github.com/hucmosin/Python_Small_Tool/blob/master/other/DVR_POC.py
Third Party Advisory https://github.com/hucmosin/MyBook/blob/master/KONGTOP_DVR_devices_vulnerability...
Third Party Advisory https://github.com/hucmosin/MyBook/blob/master/fu/DVR.pdf
Exploit https://github.com/hucmosin/Python_Small_Tool/blob/master/other/DVR_POC.py
45
/ 100
moderate-risk
Severity 32/34 · Critical
Exploitability 1/34 · Minimal
Exposure 12/34 · Low