CVE-2018-11689

Web Viewer for Hanwha DVR 2.17 and Smart Viewer in Samsung Web Viewer for Samsung DVR are vulnerable to XSS via the /cgi-bin/webviewer_login_page data3 parameter. (The same Web Viewer codebase was transitioned from Samsung to Hanwha.)

Score

CVSS 3.1 6.1 Medium

Status

Modified - cve@mitre.org

Published

2018-06-14

Last modified

2024-08-05

Weaknesses

CWE-79

Affected products

• Hrd-1641 Firmware (Hanwha-security)
• Hrd-1642 Firmware (Hanwha-security)
• Hrd-440 Firmware (Hanwha-security)
• Hrd-442 Firmware (Hanwha-security)
• Hrd-443 Firmware (Hanwha-security)
• Hrd-840 Firmware (Hanwha-security)
• Hrd-841 Firmware (Hanwha-security)
• Hrd-842 Firmware (Hanwha-security)
• Srd-1694u Firmware (Hanwha-security)
• Smartviewer (Samsung)

References

• http://www.securityfocus.com/archive/1/542083/100/0/threaded
• https://drive.google.com/file/d/1aWbvdrx1KRkUv4ikkm530a2N5qrxCLmr/view?usp=sharing
• https://seclists.org/bugtraq/2018/Jun/40
• https://vulmon.com/vulnerabilitydetails?qid=CVE-2018-11689