CVE-2021-23851
high-risk
Published 2022-03-30
A specially crafted TCP/IP packet may cause the camera recovery image web interface to crash. It may also cause a buffer overflow which could enable remote code execution. The recovery image can only be booted with administrative rights or with physical access to the camera and allows the upload of a new firmware in case of a damaged firmware.
Do I need to act?
-
0.24% chance of exploitation
EPSS score — low exploit probability
-
Not on CISA KEV list
No confirmed active exploitation reported to CISA
?
Patch status unknown
Check vendor advisories for fix availability and mitigation guidance
6
CVSS 6.8/10
Medium
PHYSICAL
/ LOW complexity
Affected Products (20)
Autodome Ip 4000I Firmware
Autodome Ip 5000I Firmware
Autodome Ip Starlight 5000I Firmware
Autodome Ip Starlight 7000I Firmware
Dinion Ip 3000I Firmware
Dinion Ip Bullet 4000I Firmware
Dinion Ip Bullet 5000 Firmware
Dinion Ip Bullet 5000I Firmware
Dinion Ip Bullet 6000I Firmware
Flexidome Ip 3000I Firmware
Flexidome Ip 4000I Firmware
Flexidome Ip 5000I Firmware
Flexidome Ip Starlight 5000I Firmware
Flexidome Ip Starlight 8000I Firmware
Mic Ip Starlight 7000I Firmware
Mic Ip Starlight 7100I Firmware
Mic Ip Ultra 7100I Firmware
Mic Ip Fusion 9000I Firmware
Dinion Ip Starlight 6000 Firmware
Dinion Ip Starlight 7000 Firmware
Affected Vendors
References (3)
51
/ 100
high-risk
Severity
22/34 · High
Exploitability
1/34 · Minimal
Exposure
28/34 · Critical