CVE-2023-30466

This vulnerability exists in Milesight 4K/H.265 Series NVR models (MS-Nxxxx-xxG, MS-Nxxxx-xxE, MS-Nxxxx-xxT, MS-Nxxxx-xxH and MS-Nxxxx-xxC), due to a weak password reset mechanism at the Milesight NVR web-based management interface. A remote attacker could exploit this vulnerability by sending a specially crafted http requests on the targeted device. Successful exploitation of this vulnerability could allow remote attacker to account takeover on the targeted device.

• milesight ms-n5008-uc firmware (< 73.9.0.18-r2) • milesight ms-n1008-unc firmware (< 73.9.0.18-r2) • milesight ms-n1008-uc firmware (< 73.9.0.18-r2) • milesight ms-n1004-uc firmware (< 73.9.0.18-r2) • milesight ms-n5016-e firmware (< 75.9.0.18-r2) • milesight ms-n5008-e firmware (< 75.9.0.18-r2) • milesight ms-n7016-uh firmware (< 71.9.0.18-r2) • milesight ms-n7032-uh firmware (< 71.9.0.18-r2) • milesight ms-n8064-uh firmware (< 71.9.0.18-r2) • milesight ms-n8032-uh firmware (< 71.9.0.18-r2) • milesight ms-n1004-upc firmware (< 73.9.0.18-r2) • milesight ms-n1008-upc firmware (< 73.9.0.18-r2) • milesight ms-n1008-unpc firmware (< 73.9.0.18-r2) • milesight ms-n5008-upc firmware (< 73.9.0.18-r2) • milesight ms-n5016-pe firmware (< 75.9.0.18-r2) • milesight ms-n5008-pe firmware (< 75.9.0.18-r2) • milesight ms-n7016-uph firmware (< 71.9.0.18-r2) • milesight ms-n7032-uph firmware (< 71.9.0.18-r2) • milesight ms-n7048-uph firmware (< 71.9.0.18-r2) • milesight ms-nxxxx-xxg firmware (< 77.9.0.18-r2) • milesight ms-nxxxx-xxt firmware (< 72.9.0.18-r2)