CVE-2023-30467 HIGH

CVE-2023-30467: Improper Authorization Vulnerability in Milesight Network Video Recorder (NVR)

Vendor Milesight
Product NVR MS-Nxxxx-xxG
Weakness CWE-285
Published April 28, 2023
Last update January 30, 2025
View on NVD All CVEs

CVSS base score

7.5/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction None
Confidentiality None
Integrity None

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

What the vulnerability does

01Description

This vulnerability exists in Milesight 4K/H.265 Series NVR models (MS-Nxxxx-xxG, MS-Nxxxx-xxE, MS-Nxxxx-xxT, MS-Nxxxx-xxH and MS-Nxxxx-xxC), due to improper authorization at the Milesight NVR web-based management interface. A remote attacker could exploit this vulnerability by sending a specially crafted http requests on the targeted device. Successful exploitation of this vulnerability could allow remote attacker to perform unauthorized activities on the targeted device.

Key dates

02Disclosure timeline

April 28, 2023 CVE published
January 30, 2025 Record updated