CVE-2020-22253 Auth bypass in n/a
Unauthenticated attackers can access Xiongmai DVR devices via an open Telnet port, enabling remote code execution and full device control.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2020-22253?
CVE-2020-22253 is a critical authentication bypass vulnerability in n/a, published on 6 Apr 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Xiongmai Technology Co devices AHB7008T-MH-V2, AHB7804R-ELS, AHB7804R-MH-V2, AHB7808R-MS-V2, AHB7808R-MS, AHB7808T-MS-V2, AHB7804R-LMS, and HI3518E_50H10L_S39 were all discovered to have port 9530 open which allows unauthenticated attackers to make arbitrary Telnet connections with the victim device.
Which versions are affected by CVE-2020-22253?
It affects 8 products.
Products include Xiongmaitech Ahb7008t-Mh-V2 Firmware, Xiongmaitech Ahb7804r-Els Firmware, Xiongmaitech Ahb7804r-Lms Firmware, Xiongmaitech Ahb7804r-Mh-V2 Firmware, Xiongmaitech Ahb7808r-Ms-V2 Firmware, Xiongmaitech Ahb7808r-Ms Firmware and 2 more.
How do I fix CVE-2020-22253?
No fix has been published for CVE-2020-22253 yet. Limit exposure of the affected software until one is available.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2020-22253 being exploited?
There is no known exploitation of CVE-2020-22253 in the wild and no public exploit code.
Other vulnerabilities in n/a
Sources
Also known as GHSA-cxgc-jm76-g3rq.