CVE-2022-45460

CRITICAL

Xiongmai NBD6808T-PL and MBD6304T Firmware - Unauthenticated Remote Code Execution via URI Buffer Overflow

Title source: llm

Exploitation Summary

EIP tracks 1 public exploit for CVE-2022-45460. PoCs published by born0monday.

AI-analyzed exploit summary This repository contains multiple Python-based exploits for CVE-2022-45460, a stack-based buffer overflow in XiongMai uc-httpd. The exploits leverage ROP chains to achieve remote code execution by overwriting the return address in the URI parsing logic.

Description

Multiple Xiongmai NVR devices, including MBD6304T V4.02.R11.00000117.10001.131900.00000 and NBD6808T-PL V4.02.R11.C7431119.12001.130000.00000, allow an unauthenticated and remote user to exploit a stack-based buffer overflow and crash the web server, resulting in a system reboot. An unauthenticated and remote attacker can execute arbitrary code by sending a crafted HTTP request that triggers the overflow condition via a long URI passed to a sprintf call. NOTE: this is different than CVE-2018-10088, but this may overlap CVE-2017-16725.

Exploits (1)

nomisec WORKING POC 5 stars

by born0monday · poc

https://github.com/born0monday/CVE-2022-45460

View Code ZIP pw:eip

This repository contains multiple Python-based exploits for CVE-2022-45460, a stack-based buffer overflow in XiongMai uc-httpd. The exploits leverage ROP chains to achieve remote code execution by overwriting the return address in the URI parsing logic.

Classification

Working Poc 95%

Attack Type

Rce

Complexity

Complex

Reliability

Reliable

Target: XiongMai uc-httpd

No auth needed

Prerequisites: Network access to the vulnerable uc-httpd service · Knowledge of the target's libc/uClibc version for ROP gadgets

MITRE ATT&CK

T1190 - Exploit Public-Facing Application T1203 - Exploitation for Client Execution T1068 - Exploitation for Privilege Escalation

devstral-2 · analyzed Feb 16, 2026 Full analysis →

References (2)

Core 2

Core References

Exploit, Third Party Advisory

https://github.com/tothi/pwn-hisilicon-dvr/blob/master/pwn_hisilicon_dvr.py

View Exploit ZIP pw:eip

Exploit, Third Party Advisory

https://vulncheck.com/advisories/xiongmai-uri-overflow

Scores

CVSS v3 9.8

EPSS 0.0567

EPSS Percentile 92.0%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CISA SSVC

Vulnrichment

Exploitation poc

Automatable yes

Technical Impact total

Details

CWE

CWE-787

Status published

Products (2)

xiongmaitech/mbd6304t_firmware 4.02.r11.00000117.10001.131900.00000

xiongmaitech/nbd6808t-pl_firmware 4.02.r11.c7431119.12001.130000.00000

Published Mar 28, 2023

Tracked Since Feb 18, 2026