Details of VAR-202208-2306

ID

VAR-202208-2306

CVE

CVE-2022-37681

TITLE

Hitachi Kokusai Electric Inc ISnex HC-IP9100HD Past traversal vulnerability in

Trust: 0.8

sources: JVNDB: JVNDB-2022-002697

DESCRIPTION

Hitachi Kokusai Electric Newtork products for monitoring system (Camera, Decoder and Encoder) and below allows attckers to perform a directory traversal via a crafted GET request to the endpoint /ptippage.cgi. Security information ID hitachi-sec-2022-001 contains fixes for the issue. Hitachi Kokusai Electric Inc ISnex HC-IP9100HD Exists in a past traversal vulnerability.Information may be obtained

Trust: 1.62

sources: NVD: CVE-2022-37681 // JVNDB: JVNDB-2022-002697

IOT TAXONOMY

category:

['camera device']

sub_category:

camera

Trust: 0.1

sources: OTHER: None

AFFECTED PRODUCTS

vendor:	hitachi	model:	hc-ip9100hd	scope:	lte	version:	1.07	Trust: 1.0
vendor:	日立国際電気	model:	hc-ip41hd	scope:	-	version:	-	Trust: 0.8
vendor:	日立国際電気	model:	pt-ip1900t	scope:	-	version:	-	Trust: 0.8
vendor:	日立国際電気	model:	hc-ip9100hd	scope:	-	version:	-	Trust: 0.8
vendor:	日立国際電気	model:	kv-h551hda	scope:	-	version:	-	Trust: 0.8
vendor:	日立国際電気	model:	hc-ip277hd	scope:	-	version:	-	Trust: 0.8
vendor:	日立国際電気	model:	hc-ip1200hd	scope:	-	version:	-	Trust: 0.8
vendor:	日立国際電気	model:	hc-ip1005hd	scope:	-	version:	-	Trust: 0.8
vendor:	日立国際電気	model:	hc-ip3100hd	scope:	-	version:	-	Trust: 0.8
vendor:	日立国際電気	model:	hc-ip3050hda	scope:	-	version:	-	Trust: 0.8
vendor:	日立国際電気	model:	hc-ip267hd	scope:	-	version:	-	Trust: 0.8
vendor:	日立国際電気	model:	kv-h551hd	scope:	-	version:	-	Trust: 0.8
vendor:	日立国際電気	model:	hc-ip3100hda	scope:	-	version:	-	Trust: 0.8
vendor:	日立国際電気	model:	hc-ip400hd	scope:	-	version:	-	Trust: 0.8
vendor:	日立国際電気	model:	hc-ip9050hd	scope:	-	version:	-	Trust: 0.8
vendor:	日立国際電気	model:	vg-ip2000	scope:	-	version:	-	Trust: 0.8
vendor:	日立国際電気	model:	kp-ip1020hd	scope:	-	version:	-	Trust: 0.8
vendor:	日立国際電気	model:	hc-ip250hda	scope:	-	version:	-	Trust: 0.8
vendor:	日立国際電気	model:	pt-ip2500r	scope:	-	version:	-	Trust: 0.8
vendor:	日立国際電気	model:	hc-ip3050hd	scope:	-	version:	-	Trust: 0.8
vendor:	日立国際電気	model:	hc-ip6000hdp	scope:	-	version:	-	Trust: 0.8

sources: JVNDB: JVNDB-2022-002697 // NVD: CVE-2022-37681

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov:	CVE-2022-37681
value:	HIGH
Trust: 1.0
hirt@hitachi.co.jp:	CVE-2022-37681
value:	HIGH
Trust: 1.0
NVD:	CVE-2022-37681
value:	HIGH
Trust: 0.8
CNNVD:	CNNVD-202208-4374
value:	HIGH
Trust: 0.6

nvd@nist.gov:	CVE-2022-37681
baseSeverity:	HIGH
baseScore:	7.5
vectorString:	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
attackVector:	NETWORK
attackComplexity:	LOW
privilegesRequired:	NONE
userInteraction:	NONE
scope:	UNCHANGED
confidentialityImpact:	HIGH
integrityImpact:	NONE
availabilityImpact:	NONE
exploitabilityScore:	3.9
impactScore:	3.6
version:	3.1
Trust: 2.0
NVD:	CVE-2022-37681
baseSeverity:	HIGH
baseScore:	7.5
vectorString:	CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
attackVector:	NETWORK
attackComplexity:	LOW
privilegesRequired:	NONE
userInteraction:	NONE
scope:	UNCHANGED
confidentialityImpact:	HIGH
integrityImpact:	NONE
availabilityImpact:	NONE
exploitabilityScore:	NONE
impactScore:	NONE
version:	3.0
Trust: 0.8

sources: JVNDB: JVNDB-2022-002697 // CNNVD: CNNVD-202208-4374 // NVD: CVE-2022-37681 // NVD: CVE-2022-37681

PROBLEMTYPE DATA

problemtype:	CWE-22	Trust: 1.0
problemtype:	Path traversal (CWE-22) [NVD evaluation ]	Trust: 0.8

sources: JVNDB: JVNDB-2022-002697 // NVD: CVE-2022-37681

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-202208-4374

TYPE

path traversal

Trust: 0.6

sources: CNNVD: CNNVD-202208-4374

PATCH

title:	Network Series	url:	https://www.hitachi-kokusai.co.jp/global/en/products/info/vulnerable/hitachi-sec-2022-001/	Trust: 0.8
title:	Hitachi Kokusai Electric ISnex HC-IP9100HD Repair measures for path traversal vulnerabilities	url:	http://123.124.177.30/web/xxk/bdxqById.tag?id=214342	Trust: 0.6

sources: JVNDB: JVNDB-2022-002697 // CNNVD: CNNVD-202208-4374

EXTERNAL IDS

db:	NVD	id:	CVE-2022-37681	Trust: 3.3
db:	JVN	id:	JVNVU97968855	Trust: 0.8
db:	JVNDB	id:	JVNDB-2022-002697	Trust: 0.8
db:	CNNVD	id:	CNNVD-202208-4374	Trust: 0.6
db:	OTHER	id:	NONE	Trust: 0.1

sources: OTHER: None // JVNDB: JVNDB-2022-002697 // CNNVD: CNNVD-202208-4374 // NVD: CVE-2022-37681

REFERENCES

url:	https://gist.github.com/nwqda/5efea18c9142c6a966d85c6be2c0c2b5	Trust: 1.6
url:	https://www.hitachi-kokusai.co.jp/global/en/products/info/vulnerable/hitachi-sec-2022-001/index.html	Trust: 1.6
url:	http://jvn.jp/vu/jvnvu97968855/index.html	Trust: 0.8
url:	https://nvd.nist.gov/vuln/detail/cve-2022-37681	Trust: 0.8
url:	https://www.hitachi-kokusai.co.jp/global/en/products/camera/network/index.html	Trust: 0.6
url:	https://cxsecurity.com/cveshow/cve-2022-37681/	Trust: 0.6
url:	https://ieeexplore.ieee.org/abstract/document/10769424	Trust: 0.1

sources: OTHER: None // JVNDB: JVNDB-2022-002697 // CNNVD: CNNVD-202208-4374 // NVD: CVE-2022-37681

SOURCES

db:	OTHER	id:	-
db:	JVNDB	id:	JVNDB-2022-002697
db:	CNNVD	id:	CNNVD-202208-4374
db:	NVD	id:	CVE-2022-37681

LAST UPDATE DATE

2025-01-30T21:26:54.879000+00:00

SOURCES UPDATE DATE

db:	JVNDB	id:	JVNDB-2022-002697	date:	2022-11-15T04:36:00
db:	CNNVD	id:	CNNVD-202208-4374	date:	2022-11-17T00:00:00
db:	NVD	id:	CVE-2022-37681	date:	2023-11-07T03:49:52.473

SOURCES RELEASE DATE

db:	JVNDB	id:	JVNDB-2022-002697	date:	2022-11-14T00:00:00
db:	CNNVD	id:	CNNVD-202208-4374	date:	2022-08-29T00:00:00
db:	NVD	id:	CVE-2022-37681	date:	2022-08-29T23:15:08.733