CVE-2023-2505 Cross-site request forgery in 4K QUAD

High 7.7 Published 22 May 2023 Updated 16 Jan 2025

A CSRF vulnerability in BirdDog cameras allows attackers to execute code and upload malicious files.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2023-2505?

CVE-2023-2505 is a high-severity vulnerability in BirdDog 4K QUAD, published on 22 May 2023. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

The affected products have a CSRF vulnerability that could allow an attacker to execute code and upload malicious files.

Weakness: CWE-352

Which versions are affected by CVE-2023-2505?

It affects 4 products.

Products include Birddog 4k Quad Firmware, Birddog A300 Firmware, Birddog Mini Firmware, Birddog Studio R3 Firmware.

How do I fix CVE-2023-2505?

No fix has been published for CVE-2023-2505 yet. Limit exposure of the affected software until one is available.

Is CVE-2023-2505 being exploited?

There is no known exploitation of CVE-2023-2505 in the wild and no public exploit code.

CVE-2023-2504 Hardcoded credentials in 4K QUAD High 8.4

Sources

Also known as GHSA-8qww-fpgr-w297.