nvd.nist.gov
https://nvd.nist.gov/vuln/detail/CVE-2022-45045 CVE-2022-45045
HIGH
xiongmaitech mbd6304t Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Record summary
CVE-2022-45045 has a selected CVSS score of 8.8 (high).
Description
Multiple Xiongmai NVR devices, including MBD6304T V4.02.R11.00000117.10001.131900.00000 and NBD6808T-PL V4.02.R11.C7431119.12001.130000.00000, allow authenticated users to execute arbitrary commands as root, as exploited in the wild starting in approximately 2019. A remote and authenticated attacker, possibly using the default admin:tlJwpbo6 credentials, can connect to port 34567 and execute arbitrary operating system commands via a crafted JSON file during an upgrade request. Since at least 2021, Xiongmai has applied patches to prevent attackers from using this mechanism to execute telnetd.
Description source: CVE List
Exploitation context
Known exploitation
- VulnCheck KEV
- Listed · Feb 20, 2019 · VulnCheck
- Reported exploitation
- Observed · VulnCheck
CISA SSVC decision
ExploitationNone
AutomatableNo
Technical impactTotal
CISA Coordinator · SSVC 2.0.3 · Evaluated Apr 24, 2025 · Source: CVE List
Affected products and versions
1| Product | Source | Version range | Status |
|---|---|---|---|
mbd6304tBrowse xiongmaitech / mbd6304t | VulnCheck | Version data not supplied | |
References
2vulncheck.com
https://vulncheck.com/blog/xiongmai-iot-exploitation