Multiple Zero-Day Vulnerabilities in Hitron Systems Security Camera DVRs

Actively exploited vulnerabilities could allow an authenticated attacker to achieve operating system command injection on affected Hitron System DVRs

Threat ID:: CC-4448
Threat Severity:: Medium
Published:: 6 February 2024 4:01 PM

Report a cyber attack: call 0300 303 5222 or email [email protected]

Summary

Actively exploited vulnerabilities could allow an authenticated attacker to achieve operating system command injection on affected Hitron System DVRs

Affected platforms

The following platforms are known to be affected:

Hitron Systems Security Camera DVR

DVR HVR-4781: prior to Version 4.03
DVR HVR-8781: prior to Version 4.03
DVR HVR-16781: prior to Version 4.03
DVR LGUVR-4H: prior to Version 4.03
DVR LGUVR-8H: prior to Version 4.03
DVR LGUVR-16H: prior to Version 4.03

Threat details

Introduction

Hitron Systems have released a security advisory to address six improper input validation vulnerabilities affecting a range of Security Camera DVRs. Each vulnerability has a CVSSv3 score of 7.4 and could allow an authenticated, remote attacker to achieve operating system command injection or to trigger a denial-of-service condition.

Exploitation observed in the wild

Active exploitation of these vulnerabilities has been observed in the wild.

Remediation advice

Affected organisations are encouraged to review CISA ICS Advisory ICSA-24-030-04 and apply the necessary updates.

Definitive source of threat updates

CVE Vulnerabilities

Status Published

CVE-2024-22768

Improper Input Validation in Hitron Systems DVR HVR-4781 1.03~4.02 allows an attacker to cause network attack in case of using defalut admin ID/PW.

Status Published

CVE-2024-22769

Improper Input Validation in Hitron Systems DVR HVR-8781 1.03~4.02 allows an attacker to cause network attack in case of using defalut admin ID/PW.

Status Published

CVE-2024-22770

Improper Input Validation in Hitron Systems DVR HVR-16781 1.03~4.02 allows an attacker to cause network attack in case of using defalut admin ID/PW.

Status Published

CVE-2024-22771

Improper Input Validation in Hitron Systems DVR LGUVR-4H 1.02~4.02 allows an attacker to cause network attack in case of using defalut admin ID/PW.

Status Published

CVE-2024-22772

Improper Input Validation in Hitron Systems DVR LGUVR-8H 1.02~4.02 allows an attacker to cause network attack in case of using defalut admin ID/PW.

Status Published

CVE-2024-23842

Improper Input Validation in Hitron Systems DVR LGUVR-16H 1.02~4.02 allows an attacker to cause network attack in case of using defalut admin ID/PW.

Last edited: 6 February 2024 4:01 pm