Skip to main content
The Website Services team at NHS England are testing early designs to understand how you find information. Your views will help us check our ideas work. Sign up to take part in our user research.

Multiple Zero-Day Vulnerabilities in Hitron Systems Security Camera DVRs

Actively exploited vulnerabilities could allow an authenticated attacker to achieve operating system command injection on affected Hitron System DVRs

Threat ID:
CC-4448
Threat Severity:
Medium
Published:
6 February 2024 4:01 PM
Report a cyber attack: call 0300 303 5222 or email [email protected]

Summary

Actively exploited vulnerabilities could allow an authenticated attacker to achieve operating system command injection on affected Hitron System DVRs

Threat details

Introduction

Hitron Systems have released a security advisory to address six improper input validation vulnerabilities affecting a range of Security Camera DVRs. Each vulnerability has a CVSSv3 score of 7.4 and could allow an authenticated, remote attacker to achieve operating system command injection or to trigger a denial-of-service condition.

Exploitation observed in the wild

Active exploitation of these vulnerabilities has been observed in the wild.

Remediation advice

Affected organisations are encouraged to review CISA ICS Advisory ICSA-24-030-04 and apply the necessary updates.

Last edited: 6 February 2024 4:01 pm