CVE-2023-3704 Timestamp Modification Vulnerability in CP-Plus Digital Video Recorder
An unauthenticated remote attacker can modify the system time of CP-Plus Digital Video Recorders via crafted HTTP requests.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2023-3704?
CVE-2023-3704 is a medium-severity vulnerability in Aditya Infotech Limited CP-UVR-1601E1-HC, CP-UVR-1601E2-H, CP-UVR-1601E1-H, CP-UVR-0801F1-HC, CP-UVR-0801K1-H, CP-UVR-0801K1B-H, CP-UVR-0808K1-H, CP-UVR-0401L1-4KH, CP-UVR-0401L1B-4KH, published on 24 Aug 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The vulnerability exists in CP-Plus DVR due to an improper input validation within the web-based management interface of the affected products. An unauthenticated remote attacker could exploit this vulnerability by sending specially crafted HTTP requests to the vulnerable device.
Successful exploitation of this vulnerability could allow the remote attacker to change system time of the targeted device.
Weakness: CWE-20
Which versions are affected by CVE-2023-3704?
It affects 9 products.
Products include Cpplusworld Cp-Uvr-0401l1-4kh Firmware, Cpplusworld Cp-Uvr-0401l1b-4kh Firmware, Cpplusworld Cp-Uvr-0801f1-Hc Firmware, Cpplusworld Cp-Uvr-0801k1-H Firmware, Cpplusworld Cp-Uvr-0801k1b-H Firmware, Cpplusworld Cp-Uvr-0808k1-H Firmware and 3 more.
How do I fix CVE-2023-3704?
No fix has been published for CVE-2023-3704 yet. Limit exposure of the affected software until one is available.
Is CVE-2023-3704 being exploited?
There is no known exploitation of CVE-2023-3704 in the wild and no public exploit code.
Sources
Also known as GHSA-8h45-26mw-gfqq.