CVEvulnerability

CVE-2017-14335

7.5 HIGH Published 2017-09-12 Modified 2026-06-17 Official page ↗
Status
Modified
Published
2017-09-12
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.0 ([email protected])
7.5 HIGH — CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
CVSS 2.0 ([email protected])
5.0 MEDIUM — AV:N/AC:L/Au:N/C:N/I:P/A:N
Weaknesses
CWE-20

Description

On Beijing Hanbang Hanbanggaoke devices, because user-controlled input is not sufficiently sanitized, sending a PUT request to /ISAPI/Security/users/1 allows an admin password change.

Affected configurations

• hbgk hb7024xt firmware • hbgk hb7032xt firmware • hbgk hb7008t2 firmware • hbgk hb7016t2 firmware • hbgk hb7204xt firmware • hbgk hb7208xt firmware • hbgk hb7216xt firmware • hbgk hb7208x3 firmware • hbgk hb7216x3 firmware • hbgk hb7204x firmware • hbgk hb7208x firmware • hbgk hb7216x firmware • hbgk 7204xr firmware • hbgk 7208xr firmware • hbgk 7216xr firmware • hbgk hb7004k firmware • hbgk hb7004kh firmware • hbgk hb7008kc firmware • hbgk hb7008kce firmware • hbgk hb7008kh firmware • hbgk hb7008khe firmware • hbgk hb7204kl firmware • hbgk hb7204kk firmware • hbgk hb7016lc firmware • hbgk hb7016lh firmware • hbgk hb7116x3 firmware • hbgk hb7108x3 firmware • hbgk hb8004 firmware • hbgk hb8008 firmware • hbgk hb8016 firmware • hbgk hb8004r firmware • hbgk hb8008r firmware • hbgk hb8016r firmware • hbgk hb8204h firmware • hbgk hb8208h firmware • hbgk hb8216h firmware • hbgk hb8204hr firmware • hbgk hb8208hr firmware • hbgk hb8216hr firmware • hbgk hb8208x3 firmware • hbgk hb8216x3 firmware • hbgk hb8608x3 firmware • hbgk hb8616x3 firmware • hbgk hb8808x3 firmware • hbgk hb8816x3 firmware • hbgk hb9404x3 firmware • hbgk hb9408x3 firmware • hbgk hb9604x3 firmware • hbgk hb9608x3 firmware • hbgk hb9012x3 firmware • hbgk hb9020x3 firmware • hbgk hb9212x3 firmware • hbgk hb9220x3 firmware • hbgk hb7904 firmware • hbgk hb7908 firmware • hbgk hb7916s firmware • hbgk hb7904x firmware • hbgk hb7908x firmware • hbgk hb7916sx firmware • hbgk hb9904 firmware … and 9 more

Related

Weakness · CWE (1)

  • CWE-20 Improper Input Validation weakness

References