Details of VAR-202209-1211

ID

VAR-202209-1211

CVE

CVE-2022-3001

TITLE

Milesight Technology of video management systems Firmware Input Validation Vulnerability

Trust: 0.8

sources: JVNDB: JVNDB-2022-017060

DESCRIPTION

This vulnerability exists in Milesight Video Management Systems (VMS), all firmware versions prior to 40.7.0.79-r1, due to improper input handling at camera’s web-based management interface. A remote attacker could exploit this vulnerability by sending a specially crafted http request on the targeted network camera. Successful exploitation of this vulnerability could allow the attacker to cause a Denial of Service condition on the targeted device

Trust: 1.71

sources: NVD: CVE-2022-3001 // JVNDB: JVNDB-2022-017060 // VULMON: CVE-2022-3001

IOT TAXONOMY

category:

['camera device']

sub_category:

camera

Trust: 0.1

sources: OTHER: None

AFFECTED PRODUCTS

vendor:	milesight	model:	video management systems	scope:	lt	version:	40.7.0.79	Trust: 1.0
vendor:	milesight	model:	video management systems	scope:	eq	version:	40.7.0.79	Trust: 1.0
vendor:	milesight	model:	video management systems	scope:	eq	version:	video management systems firmware 40.7.0.79	Trust: 0.8
vendor:	milesight	model:	video management systems	scope:	eq	version:	-	Trust: 0.8
vendor:	milesight	model:	video management systems	scope:	-	version:	-	Trust: 0.8

sources: JVNDB: JVNDB-2022-017060 // NVD: CVE-2022-3001

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov:	CVE-2022-3001
value:	HIGH
Trust: 1.0
vdisclose@cert-in.org.in:	CVE-2022-3001
value:	HIGH
Trust: 1.0
NVD:	CVE-2022-3001
value:	HIGH
Trust: 0.8
CNNVD:	CNNVD-202209-1091
value:	HIGH
Trust: 0.6

nvd@nist.gov:	CVE-2022-3001
baseSeverity:	HIGH
baseScore:	7.5
vectorString:	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
attackVector:	NETWORK
attackComplexity:	LOW
privilegesRequired:	NONE
userInteraction:	NONE
scope:	UNCHANGED
confidentialityImpact:	NONE
integrityImpact:	NONE
availabilityImpact:	HIGH
exploitabilityScore:	3.9
impactScore:	3.6
version:	3.1
Trust: 2.0
NVD:	CVE-2022-3001
baseSeverity:	HIGH
baseScore:	7.5
vectorString:	CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
attackVector:	NETWORK
attackComplexity:	LOW
privilegesRequired:	NONE
userInteraction:	NONE
scope:	UNCHANGED
confidentialityImpact:	NONE
integrityImpact:	NONE
availabilityImpact:	HIGH
exploitabilityScore:	NONE
impactScore:	NONE
version:	3.0
Trust: 0.8

sources: JVNDB: JVNDB-2022-017060 // CNNVD: CNNVD-202209-1091 // NVD: CVE-2022-3001 // NVD: CVE-2022-3001

PROBLEMTYPE DATA

problemtype:	CWE-20	Trust: 1.0
problemtype:	Inappropriate input confirmation (CWE-20) [NVD evaluation ]	Trust: 0.8

sources: JVNDB: JVNDB-2022-017060 // NVD: CVE-2022-3001

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-202209-1091

TYPE

input validation error

Trust: 0.6

sources: CNNVD: CNNVD-202209-1091

PATCH

title:

Milesight Video Management Systems Enter the fix for the verification error vulnerability

url:

http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=208296

Trust: 0.6

sources: CNNVD: CNNVD-202209-1091

EXTERNAL IDS

db:	NVD	id:	CVE-2022-3001	Trust: 3.4
db:	JVNDB	id:	JVNDB-2022-017060	Trust: 0.8
db:	CNNVD	id:	CNNVD-202209-1091	Trust: 0.6
db:	OTHER	id:	NONE	Trust: 0.1
db:	VULMON	id:	CVE-2022-3001	Trust: 0.1

sources: OTHER: None // VULMON: CVE-2022-3001 // JVNDB: JVNDB-2022-017060 // CNNVD: CNNVD-202209-1091 // NVD: CVE-2022-3001

REFERENCES

url:	https://www.cert-in.org.in/s2cmainservlet?pageid=pubvlnotes01&vlcode=civn-2022-0352	Trust: 2.5
url:	https://nvd.nist.gov/vuln/detail/cve-2022-3001	Trust: 0.8
url:	https://cxsecurity.com/cveshow/cve-2022-3001/	Trust: 0.6
url:	https://ieeexplore.ieee.org/abstract/document/10769424	Trust: 0.1
url:	https://nvd.nist.gov	Trust: 0.1

sources: OTHER: None // VULMON: CVE-2022-3001 // JVNDB: JVNDB-2022-017060 // CNNVD: CNNVD-202209-1091 // NVD: CVE-2022-3001

SOURCES

db:	OTHER	id:	-
db:	VULMON	id:	CVE-2022-3001
db:	JVNDB	id:	JVNDB-2022-017060
db:	CNNVD	id:	CNNVD-202209-1091
db:	NVD	id:	CVE-2022-3001

LAST UPDATE DATE

2025-01-30T20:28:15.206000+00:00

SOURCES UPDATE DATE

db:	VULMON	id:	CVE-2022-3001	date:	2022-09-15T00:00:00
db:	JVNDB	id:	JVNDB-2022-017060	date:	2023-10-10T08:22:00
db:	CNNVD	id:	CNNVD-202209-1091	date:	2022-09-20T00:00:00
db:	NVD	id:	CVE-2022-3001	date:	2022-09-19T19:08:04.817

SOURCES RELEASE DATE

db:	VULMON	id:	CVE-2022-3001	date:	2022-09-15T00:00:00
db:	JVNDB	id:	JVNDB-2022-017060	date:	2023-10-10T00:00:00
db:	CNNVD	id:	CNNVD-202209-1091	date:	2022-09-15T00:00:00
db:	NVD	id:	CVE-2022-3001	date:	2022-09-15T15:15:10.400