Vulnerability-Lookup

BDU:2024-06307

Vulnerability from fstec - Published: 01.08.2024

Title

Уязвимость программного обеспечения гибридных HD-видеорегистраторов TD-2104TS-CL, TD-2108TS-HP, TD-2116TE-HP, AV108T, SH-4050A5-5L(MM) и SH-8100A-2L(MM), связанная с отсутствием защиты служебных данных, позволяющая нарушителю раскрыть защищаемую информацию

Description

Уязвимость программного обеспечения гибридных HD-видеорегистраторов TD-2104TS-CL, TD-2108TS-HP, TD-2116TE-HP, AV108T, SH-4050A5-5L(MM) и SH-8100A-2L(MM) связана с отсутствием защиты служебных данных. Эксплуатация уязвимости может позволить нарушителю, действуюещему удаленно, раскрыть защищаемую информацию

Severity ?


                    
                      AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Vendor

Artion Security Systems

Software Name

TD-2104TS-CL, TD-2108TS-HP, TD-2116TE-HP, AV108T, SH-4050A5-5L(MM), SH-8100A-2L(MM)

Software Version

1.3.4.22966B181219.D00.U1(4A21S) (TD-2104TS-CL), 1.3.4.22966B181219.D14.U1(8A41T) (TD-2108TS-HP), 1.3.4.22966B181219.D44.U1(16A82T) (TD-2116TE-HP), 1.3.4.24513B190218.D00.U1(8A21S) (AV108T), 1.3.3.20657B180918.D06.U2(4A41T) (SH-4050A5-5L(MM)), 1.3.4.24879B190222.D00.U2(8A21S) (SH-8100A-2L(MM))

Possible Mitigations

Компенсирующие меры: - ограничить доступ к устройству; - использовать механизмы аутентификации для управления доступом к интерфейсам устройств.

Reference

https://netsecfish.notion.site/Sensitive-Device-Information-Disclosure-in-TVT-DVR-fad1cce703d946969be5130bf3aaac0d?pvs=4 https://vuldb.com/?ctiid.273262 https://vuldb.com/?id.273262 https://vuldb.com/?submit.379373

CWE

CWE-200

JSON

To clipboard

{
  "CVSS 2.0": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
  "CVSS 3.0": "AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
  "CVSS 4.0": null,
  "remediation_\u0418\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440": null,
  "remediation_\u041d\u0430\u0438\u043c\u0435\u043d\u043e\u0432\u0430\u043d\u0438\u0435": null,
  "\u0412\u0435\u043d\u0434\u043e\u0440 \u041f\u041e": "Artion Security Systems",
  "\u0412\u0435\u0440\u0441\u0438\u044f \u041f\u041e": "1.3.4.22966B181219.D00.U1(4A21S) (TD-2104TS-CL), 1.3.4.22966B181219.D14.U1(8A41T) (TD-2108TS-HP), 1.3.4.22966B181219.D44.U1(16A82T) (TD-2116TE-HP), 1.3.4.24513B190218.D00.U1(8A21S) (AV108T), 1.3.3.20657B180918.D06.U2(4A41T) (SH-4050A5-5L(MM)), 1.3.4.24879B190222.D00.U2(8A21S) (SH-8100A-2L(MM))",
  "\u0412\u043e\u0437\u043c\u043e\u0436\u043d\u044b\u0435 \u043c\u0435\u0440\u044b \u043f\u043e \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u044e": "\u041a\u043e\u043c\u043f\u0435\u043d\u0441\u0438\u0440\u0443\u044e\u0449\u0438\u0435 \u043c\u0435\u0440\u044b:\n- \u043e\u0433\u0440\u0430\u043d\u0438\u0447\u0438\u0442\u044c \u0434\u043e\u0441\u0442\u0443\u043f \u043a \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432\u0443;\n- \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c \u043c\u0435\u0445\u0430\u043d\u0438\u0437\u043c\u044b \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438 \u0434\u043b\u044f \u0443\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u044f \u0434\u043e\u0441\u0442\u0443\u043f\u043e\u043c \u043a \u0438\u043d\u0442\u0435\u0440\u0444\u0435\u0439\u0441\u0430\u043c \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432.",
  "\u0414\u0430\u0442\u0430 \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0438\u044f": "01.08.2024",
  "\u0414\u0430\u0442\u0430 \u043f\u043e\u0441\u043b\u0435\u0434\u043d\u0435\u0433\u043e \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u044f": "19.08.2024",
  "\u0414\u0430\u0442\u0430 \u043f\u0443\u0431\u043b\u0438\u043a\u0430\u0446\u0438\u0438": "19.08.2024",
  "\u0418\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440": "BDU:2024-06307",
  "\u0418\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440\u044b \u0434\u0440\u0443\u0433\u0438\u0445 \u0441\u0438\u0441\u0442\u0435\u043c \u043e\u043f\u0438\u0441\u0430\u043d\u0438\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "CVE-2024-7339",
  "\u0418\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044f \u043e\u0431 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u0438": "\u0418\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044f \u043e\u0431 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u0438 \u043e\u0442\u0441\u0443\u0442\u0441\u0442\u0432\u0443\u0435\u0442",
  "\u041a\u043b\u0430\u0441\u0441 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043a\u043e\u0434\u0430",
  "\u041d\u0430\u0437\u0432\u0430\u043d\u0438\u0435 \u041f\u041e": "TD-2104TS-CL, TD-2108TS-HP, TD-2116TE-HP, AV108T, SH-4050A5-5L(MM), SH-8100A-2L(MM)",
  "\u041d\u0430\u0438\u043c\u0435\u043d\u043e\u0432\u0430\u043d\u0438\u0435 \u041e\u0421 \u0438 \u0442\u0438\u043f \u0430\u043f\u043f\u0430\u0440\u0430\u0442\u043d\u043e\u0439 \u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u044b": null,
  "\u041d\u0430\u0438\u043c\u0435\u043d\u043e\u0432\u0430\u043d\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0433\u043e \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u044f \u0433\u0438\u0431\u0440\u0438\u0434\u043d\u044b\u0445 HD-\u0432\u0438\u0434\u0435\u043e\u0440\u0435\u0433\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\u043e\u0432 TD-2104TS-CL, TD-2108TS-HP, TD-2116TE-HP, AV108T, SH-4050A5-5L(MM) \u0438 SH-8100A-2L(MM), \u0441\u0432\u044f\u0437\u0430\u043d\u043d\u0430\u044f \u0441 \u043e\u0442\u0441\u0443\u0442\u0441\u0442\u0432\u0438\u0435\u043c \u0437\u0430\u0449\u0438\u0442\u044b \u0441\u043b\u0443\u0436\u0435\u0431\u043d\u044b\u0445 \u0434\u0430\u043d\u043d\u044b\u0445, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u043d\u0430\u0440\u0443\u0448\u0438\u0442\u0435\u043b\u044e \u0440\u0430\u0441\u043a\u0440\u044b\u0442\u044c \u0437\u0430\u0449\u0438\u0449\u0430\u0435\u043c\u0443\u044e \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044e",
  "\u041d\u0430\u043b\u0438\u0447\u0438\u0435 \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442\u0430": "\u0421\u0443\u0449\u0435\u0441\u0442\u0432\u0443\u0435\u0442 \u0432 \u043e\u0442\u043a\u0440\u044b\u0442\u043e\u043c \u0434\u043e\u0441\u0442\u0443\u043f\u0435",
  "\u041e\u043f\u0438\u0441\u0430\u043d\u0438\u0435 \u043e\u0448\u0438\u0431\u043a\u0438 CWE": "\u0420\u0430\u0441\u043a\u0440\u044b\u0442\u0438\u0435 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u0438 (CWE-200)",
  "\u041e\u043f\u0438\u0441\u0430\u043d\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0433\u043e \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u044f \u0433\u0438\u0431\u0440\u0438\u0434\u043d\u044b\u0445 HD-\u0432\u0438\u0434\u0435\u043e\u0440\u0435\u0433\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\u043e\u0432 TD-2104TS-CL, TD-2108TS-HP, TD-2116TE-HP, AV108T, SH-4050A5-5L(MM) \u0438 SH-8100A-2L(MM) \u0441\u0432\u044f\u0437\u0430\u043d\u0430 \u0441 \u043e\u0442\u0441\u0443\u0442\u0441\u0442\u0432\u0438\u0435\u043c \u0437\u0430\u0449\u0438\u0442\u044b \u0441\u043b\u0443\u0436\u0435\u0431\u043d\u044b\u0445 \u0434\u0430\u043d\u043d\u044b\u0445. \u042d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u043c\u043e\u0436\u0435\u0442 \u043f\u043e\u0437\u0432\u043e\u043b\u0438\u0442\u044c \u043d\u0430\u0440\u0443\u0448\u0438\u0442\u0435\u043b\u044e, \u0434\u0435\u0439\u0441\u0442\u0432\u0443\u044e\u0435\u0449\u0435\u043c\u0443 \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u043e, \u0440\u0430\u0441\u043a\u0440\u044b\u0442\u044c \u0437\u0430\u0449\u0438\u0449\u0430\u0435\u043c\u0443\u044e \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044e",
  "\u041f\u043e\u0441\u043b\u0435\u0434\u0441\u0442\u0432\u0438\u044f \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": null,
  "\u041f\u0440\u043e\u0447\u0430\u044f \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044f": null,
  "\u0421\u0432\u044f\u0437\u044c \u0441 \u0438\u043d\u0446\u0438\u0434\u0435\u043d\u0442\u0430\u043c\u0438 \u0418\u0411": "\u0414\u0430\u043d\u043d\u044b\u0435 \u0443\u0442\u043e\u0447\u043d\u044f\u044e\u0442\u0441\u044f",
  "\u0421\u043e\u0441\u0442\u043e\u044f\u043d\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u041e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d\u0430",
  "\u0421\u043f\u043e\u0441\u043e\u0431 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u044f": "\u0414\u0430\u043d\u043d\u044b\u0435 \u0443\u0442\u043e\u0447\u043d\u044f\u044e\u0442\u0441\u044f",
  "\u0421\u043f\u043e\u0441\u043e\u0431 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438": "\u041d\u0435\u0441\u0430\u043d\u043a\u0446\u0438\u043e\u043d\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0439 \u0441\u0431\u043e\u0440 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u0438",
  "\u0421\u0441\u044b\u043b\u043a\u0438 \u043d\u0430 \u0438\u0441\u0442\u043e\u0447\u043d\u0438\u043a\u0438": "https://netsecfish.notion.site/Sensitive-Device-Information-Disclosure-in-TVT-DVR-fad1cce703d946969be5130bf3aaac0d?pvs=4\t\nhttps://vuldb.com/?ctiid.273262\t\nhttps://vuldb.com/?id.273262\t\nhttps://vuldb.com/?submit.379373",
  "\u0421\u0442\u0430\u0442\u0443\u0441 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u041f\u043e\u0442\u0435\u043d\u0446\u0438\u0430\u043b\u044c\u043d\u0430\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c",
  "\u0422\u0438\u043f \u041f\u041e": "\u041f\u041e \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e-\u0430\u043f\u043f\u0430\u0440\u0430\u0442\u043d\u043e\u0433\u043e \u0441\u0440\u0435\u0434\u0441\u0442\u0432\u0430",
  "\u0422\u0438\u043f \u043e\u0448\u0438\u0431\u043a\u0438 CWE": "CWE-200",
  "\u0423\u0440\u043e\u0432\u0435\u043d\u044c \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u0421\u0440\u0435\u0434\u043d\u0438\u0439 \u0443\u0440\u043e\u0432\u0435\u043d\u044c \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 (\u0431\u0430\u0437\u043e\u0432\u0430\u044f \u043e\u0446\u0435\u043d\u043a\u0430 CVSS 2.0 \u0441\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u0442 5)\n\u0421\u0440\u0435\u0434\u043d\u0438\u0439 \u0443\u0440\u043e\u0432\u0435\u043d\u044c \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 (\u0431\u0430\u0437\u043e\u0432\u0430\u044f \u043e\u0446\u0435\u043d\u043a\u0430 CVSS 3.0 \u0441\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u0442 5,3)"
}

CVE-2024-7339 (GCVE-0-2024-7339)

Vulnerability from cvelistv5 – Published: 2024-08-01 04:00 – Updated: 2024-08-07 14:31

Title

TVT DVR TD-2104TS-CL queryDevInfo information disclosure

Summary

A vulnerability has been found in TVT DVR TD-2104TS-CL, DVR TD-2108TS-HP, Provision-ISR DVR SH-4050A5-5L(MM) and AVISION DVR AV108T and classified as problematic. This vulnerability affects unknown code of the file /queryDevInfo. The manipulation leads to information disclosure. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-273262 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.

Severity ?

6.9 (Medium)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

5.3 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

5.3 (Medium)


                        
                          CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

CWE

CWE-200 - Information Disclosure

Assigner

VulDB

References

URL

Tags

	https://vuldb.com/?id.273262	vdb-entry
	https://vuldb.com/?ctiid.273262	signaturepermissions-required
	https://vuldb.com/?submit.379373	third-party-advisory
	https://netsecfish.notion.site/Sensitive-Device-I…	exploit

Impacted products

Vendor

Product

Version

TVT

DVR TD-2104TS-CL

Affected: 1.3.3.20657B180918.D06.U2(4A41T)
Affected: 1.3.4.22966B181219.D00.U1(4A21S)
Affected: 1.3.4.22966B181219.D14.U1(8A41T)
Affected: 1.3.4.22966B181219.D44.U1(16A82T)
Affected: 1.3.4.24513B190218.D00.U1(8A21S)
Affected: 1.3.4.24879B190222.D00.U2(8A21S)

TVT	DVR TD-2108TS-HP	Affected: 1.3.3.20657B180918.D06.U2(4A41T) Affected: 1.3.4.22966B181219.D00.U1(4A21S) Affected: 1.3.4.22966B181219.D14.U1(8A41T) Affected: 1.3.4.22966B181219.D44.U1(16A82T) Affected: 1.3.4.24513B190218.D00.U1(8A21S) Affected: 1.3.4.24879B190222.D00.U2(8A21S)
TVT	Provision-ISR DVR SH-4050A5-5L(MM)	Affected: 1.3.3.20657B180918.D06.U2(4A41T) Affected: 1.3.4.22966B181219.D00.U1(4A21S) Affected: 1.3.4.22966B181219.D14.U1(8A41T) Affected: 1.3.4.22966B181219.D44.U1(16A82T) Affected: 1.3.4.24513B190218.D00.U1(8A21S) Affected: 1.3.4.24879B190222.D00.U2(8A21S)
TVT	AVISION DVR AV108T	Affected: 1.3.3.20657B180918.D06.U2(4A41T) Affected: 1.3.4.22966B181219.D00.U1(4A21S) Affected: 1.3.4.22966B181219.D14.U1(8A41T) Affected: 1.3.4.22966B181219.D44.U1(16A82T) Affected: 1.3.4.24513B190218.D00.U1(8A21S) Affected: 1.3.4.24879B190222.D00.U2(8A21S)

Credits

netsecfish (VulDB User)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:a:tvt:dvr_td_2014ts_cl:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "dvr_td_2014ts_cl",
            "vendor": "tvt",
            "versions": [
              {
                "status": "affected",
                "version": "1.3.3.20657B180918.D06.U2\\/4A41T\\/"
              },
              {
                "status": "affected",
                "version": "1.3.4.22966B181219.D00.U1\\/4A21S\\/"
              },
              {
                "status": "affected",
                "version": "1.3.4.22966B181219.D14.U1\\/8A41T\\/"
              },
              {
                "status": "affected",
                "version": "1.3.4.22966B181219.D44.U1\\/16A82T\\/"
              },
              {
                "status": "affected",
                "version": "1.3.4.24513B190218.D00.U1\\/8A21S\\/"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:a:tvt:dvr_td_2018ts_hp:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "dvr_td_2018ts_hp",
            "vendor": "tvt",
            "versions": [
              {
                "status": "affected",
                "version": "1.3.3.20657B180918.D06.U2\\/4A41T\\/"
              },
              {
                "status": "affected",
                "version": "1.3.4.22966B181219.D00.U1\\/4A21S\\/"
              },
              {
                "status": "affected",
                "version": "1.3.4.22966B181219.D14.U1\\/8A41T\\/"
              },
              {
                "status": "affected",
                "version": "1.3.4.22966B181219.D44.U1\\/16A82T\\/"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:a:tvt:provision_isr_dvr_sh_4050a5_5l\\/mm\\/:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "provision_isr_dvr_sh_4050a5_5l\\/mm\\/",
            "vendor": "tvt",
            "versions": [
              {
                "status": "affected",
                "version": "1.3.3.20657B180918.D06.U2\\/4A41T\\/"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:a:tvt:dvr_td_2014ts_cl:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "dvr_td_2014ts_cl",
            "vendor": "tvt",
            "versions": [
              {
                "status": "affected",
                "version": "1.3.4.24879B190222.D00.U2\\/8A21S\\/"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:a:tvt:dvr_td_2018ts_hp:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "dvr_td_2018ts_hp",
            "vendor": "tvt",
            "versions": [
              {
                "status": "affected",
                "version": "1.3.4.24513B190218.D00.U\\/(8A21S\\/"
              },
              {
                "status": "affected",
                "version": "1.3.4.24879B190222.D00.U2\\/8A21S\\/"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:a:tvt:provision_isr_dvr_sh_4050a5_5l\\/mm\\/:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "provision_isr_dvr_sh_4050a5_5l\\/mm\\/",
            "vendor": "tvt",
            "versions": [
              {
                "status": "affected",
                "version": "1.3.4.22966B181219.D00.U\\/(4A21S\\/"
              },
              {
                "status": "affected",
                "version": "1.3.4.22966B181219.D14.U1\\/8A41T\\/"
              },
              {
                "status": "affected",
                "version": "1.3.4.22966B181219.D44.U1\\/16A82T\\/"
              },
              {
                "status": "affected",
                "version": "1.3.4.24513B190218.D00.U1\\/8A21S\\/"
              },
              {
                "status": "affected",
                "version": "1.3.4.24879B190222.D00.U2\\/8A21S\\/"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:a:tvt:avision_dvr_av108t:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "avision_dvr_av108t",
            "vendor": "tvt",
            "versions": [
              {
                "status": "affected",
                "version": "1.3.3.20657B180918.D06.U2\\/4A41T\\/"
              },
              {
                "status": "affected",
                "version": "1.3.4.22966B181219.D00.U\\/(4A21S\\/"
              },
              {
                "status": "affected",
                "version": "1.3.4.22966B181219.D14.U1\\/8A41T\\/"
              },
              {
                "status": "affected",
                "version": "1.3.4.22966B181219.D44.U1\\/16A82T\\/"
              },
              {
                "status": "affected",
                "version": "1.3.4.24513B190218.D00.U\\/8A21S\\/"
              },
              {
                "status": "affected",
                "version": "1.3.4.24879B190222.D00.U2\\/8A21S\\/"
              }
            ]
          }
        ],
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-7339",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-08-01T13:22:06.986415Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-08-07T14:31:11.792Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "DVR TD-2104TS-CL",
          "vendor": "TVT",
          "versions": [
            {
              "status": "affected",
              "version": "1.3.3.20657B180918.D06.U2(4A41T)"
            },
            {
              "status": "affected",
              "version": "1.3.4.22966B181219.D00.U1(4A21S)"
            },
            {
              "status": "affected",
              "version": "1.3.4.22966B181219.D14.U1(8A41T)"
            },
            {
              "status": "affected",
              "version": "1.3.4.22966B181219.D44.U1(16A82T)"
            },
            {
              "status": "affected",
              "version": "1.3.4.24513B190218.D00.U1(8A21S)"
            },
            {
              "status": "affected",
              "version": "1.3.4.24879B190222.D00.U2(8A21S)"
            }
          ]
        },
        {
          "product": "DVR TD-2108TS-HP",
          "vendor": "TVT",
          "versions": [
            {
              "status": "affected",
              "version": "1.3.3.20657B180918.D06.U2(4A41T)"
            },
            {
              "status": "affected",
              "version": "1.3.4.22966B181219.D00.U1(4A21S)"
            },
            {
              "status": "affected",
              "version": "1.3.4.22966B181219.D14.U1(8A41T)"
            },
            {
              "status": "affected",
              "version": "1.3.4.22966B181219.D44.U1(16A82T)"
            },
            {
              "status": "affected",
              "version": "1.3.4.24513B190218.D00.U1(8A21S)"
            },
            {
              "status": "affected",
              "version": "1.3.4.24879B190222.D00.U2(8A21S)"
            }
          ]
        },
        {
          "product": "Provision-ISR DVR SH-4050A5-5L(MM)",
          "vendor": "TVT",
          "versions": [
            {
              "status": "affected",
              "version": "1.3.3.20657B180918.D06.U2(4A41T)"
            },
            {
              "status": "affected",
              "version": "1.3.4.22966B181219.D00.U1(4A21S)"
            },
            {
              "status": "affected",
              "version": "1.3.4.22966B181219.D14.U1(8A41T)"
            },
            {
              "status": "affected",
              "version": "1.3.4.22966B181219.D44.U1(16A82T)"
            },
            {
              "status": "affected",
              "version": "1.3.4.24513B190218.D00.U1(8A21S)"
            },
            {
              "status": "affected",
              "version": "1.3.4.24879B190222.D00.U2(8A21S)"
            }
          ]
        },
        {
          "product": "AVISION DVR AV108T",
          "vendor": "TVT",
          "versions": [
            {
              "status": "affected",
              "version": "1.3.3.20657B180918.D06.U2(4A41T)"
            },
            {
              "status": "affected",
              "version": "1.3.4.22966B181219.D00.U1(4A21S)"
            },
            {
              "status": "affected",
              "version": "1.3.4.22966B181219.D14.U1(8A41T)"
            },
            {
              "status": "affected",
              "version": "1.3.4.22966B181219.D44.U1(16A82T)"
            },
            {
              "status": "affected",
              "version": "1.3.4.24513B190218.D00.U1(8A21S)"
            },
            {
              "status": "affected",
              "version": "1.3.4.24879B190222.D00.U2(8A21S)"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "netsecfish (VulDB User)"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A vulnerability has been found in TVT DVR TD-2104TS-CL, DVR TD-2108TS-HP, Provision-ISR DVR SH-4050A5-5L(MM) and AVISION DVR AV108T and classified as problematic. This vulnerability affects unknown code of the file /queryDevInfo. The manipulation leads to information disclosure. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-273262 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way."
        },
        {
          "lang": "de",
          "value": "In TVT DVR TD-2104TS-CL, DVR TD-2108TS-HP, Provision-ISR DVR SH-4050A5-5L(MM) and AVISION DVR AV108T wurde eine problematische Schwachstelle gefunden. Betroffen ist eine unbekannte Verarbeitung der Datei /queryDevInfo. Dank der Manipulation mit unbekannten Daten kann eine information disclosure-Schwachstelle ausgenutzt werden. Der Angriff kann \u00fcber das Netzwerk passieren. Der Exploit steht zur \u00f6ffentlichen Verf\u00fcgung."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "baseScore": 6.9,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0"
          }
        },
        {
          "cvssV3_1": {
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.1"
          }
        },
        {
          "cvssV3_0": {
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.0"
          }
        },
        {
          "cvssV2_0": {
            "baseScore": 5,
            "vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
            "version": "2.0"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-200",
              "description": "CWE-200 Information Disclosure",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-08-01T04:00:10.091Z",
        "orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
        "shortName": "VulDB"
      },
      "references": [
        {
          "name": "VDB-273262 | TVT DVR TD-2104TS-CL queryDevInfo information disclosure",
          "tags": [
            "vdb-entry"
          ],
          "url": "https://vuldb.com/?id.273262"
        },
        {
          "name": "VDB-273262 | CTI Indicators (IOB, IOC, TTP, IOA)",
          "tags": [
            "signature",
            "permissions-required"
          ],
          "url": "https://vuldb.com/?ctiid.273262"
        },
        {
          "name": "Submit #379373 | TVT TD-2104TS-CL, TD-2108TS-HP, SH-4050A5-5L(MM), AV108T, ... 1.3.4.22966B181219.D00.U1(4A21S), 1.3.4.22966B181219.D14.U1(8A41T), 1.3.4.22966B181219.D44.U1(16A82T), 1.3.4.24513B190218.D00.U1 Information Disclosure",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://vuldb.com/?submit.379373"
        },
        {
          "tags": [
            "exploit"
          ],
          "url": "https://netsecfish.notion.site/Sensitive-Device-Information-Disclosure-in-TVT-DVR-fad1cce703d946969be5130bf3aaac0d?pvs=4"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2024-07-31T00:00:00.000Z",
          "value": "Advisory disclosed"
        },
        {
          "lang": "en",
          "time": "2024-07-31T02:00:00.000Z",
          "value": "VulDB entry created"
        },
        {
          "lang": "en",
          "time": "2024-07-31T14:40:33.000Z",
          "value": "VulDB entry last update"
        }
      ],
      "title": "TVT DVR TD-2104TS-CL queryDevInfo information disclosure"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
    "assignerShortName": "VulDB",
    "cveId": "CVE-2024-7339",
    "datePublished": "2024-08-01T04:00:10.091Z",
    "dateReserved": "2024-07-31T12:34:44.446Z",
    "dateUpdated": "2024-08-07T14:31:11.792Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

BDU:2024-06307

CVE-2024-7339 (GCVE-0-2024-7339)

Tags

Sightings

Nomenclature