CVE-2024-5631 Information disclosure in NVR3608PGE2W
An on-path attacker can eavesdrop on unencrypted login credentials transmitted during password changes, allowing access to video streams.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2024-5631?
CVE-2024-5631 is a medium-severity vulnerability in Longse Technology NVR3608PGE2W, published on 9 Jul 2024. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
Longse NVR (Network Video Recorder) model NVR3608PGE2W, as well as products based on this device, are transmitting user's login and password to a remote control service without using any encryption. This enables an on-path attacker to eavesdrop the credentials and subsequently obtain access to the video stream. The credentials are being sent when a user decides to change his password in router's portal.
Weakness: CWE-319
Which versions are affected by CVE-2024-5631?
How do I fix CVE-2024-5631?
No fix has been published for CVE-2024-5631 yet. Limit exposure of the affected software until one is available.
Is CVE-2024-5631 being exploited?
There is no known exploitation of CVE-2024-5631 in the wild and no public exploit code.
Sources
Also known as GHSA-37h9-9838-7j9c.