CVE-2019-12223 Memory corruption in n/a
An attacker can cause a denial of service on Hanwha Techwin NVR devices by submitting a long username that triggers a buffer overflow and system reboot.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2019-12223?
CVE-2019-12223 is a high-severity memory corruption vulnerability in n/a, published on 5 Sep 2019. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
An issue was discovered in NVR WebViewer on Hanwah Techwin SRN-472s 1.07_190502 devices, and other SRN-x devices before 2019-05-03. A system crash and reboot can be achieved by submitting a long username in excess of 117 characters. The username triggers a buffer overflow in the main process controlling operation of the DVR system, rendering services unavailable during the reboot operation. A repeated attack affects availability as long as the attacker has network access to the device.
Weakness: CWE-119
Which versions are affected by CVE-2019-12223?
It affects 3 products.
Products include Hanwha-Security Srn-1673s Firmware, Hanwha-Security Srn-472s Firmware, Hanwha-Security Srn-873s Firmware.
How do I fix CVE-2019-12223?
No fix has been published for CVE-2019-12223 yet. Limit exposure of the affected software until one is available.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2019-12223 being exploited?
There is no known exploitation of CVE-2019-12223 in the wild and no public exploit code.
Sources
Also known as GHSA-fjr3-w9q4-qj56.