CVE-2018-6294 Auth bypass in Hanwha Techwin Smartcams
Attackers can bypass authentication to perform unauthorized firmware updates on Hanwha Techwin Smartcams, potentially gaining full control.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2018-6294?
CVE-2018-6294 is a critical authentication bypass vulnerability in Hanwha Techwin Smartcams, published on 13 Mar 2018. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Unsecured way of firmware update in Hanwha Techwin Smartcams
Weakness: CWE-287
Which versions are affected by CVE-2018-6294?
It affects 2 products.
Products include Hanwha-Security Snh-V6410pn Firmware, Hanwha-Security Snh-V6410pnw Firmware.
How do I fix CVE-2018-6294?
No fix has been published for CVE-2018-6294 yet. Limit exposure of the affected software until one is available.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2018-6294 being exploited?
There is no known exploitation of CVE-2018-6294 in the wild and no public exploit code.
Other vulnerabilities in Hanwha Techwin Smartcams
Sources
Also known as GHSA-f46g-3335-c923.