CVE-2024-0305

MEDIUMNuclei

Guangzhou Yingke Electronic Technology Ncast Guest Login IPSetup.php information disclosure

Title source: CVE List
Search associated code STIX 2.1 vulnerability STIX 2.1 with PoCs

Record summary

CVE-2024-0305 has a selected CVSS score of 5.3 (medium); EIP currently links 1 repository PoC and 1 Nuclei template.

Description

A vulnerability was found in Guangzhou Yingke Electronic Technology Ncast up to 2017 and classified as problematic. Affected by this issue is some unknown functionality of the file /manage/IPSetup.php of the component Guest Login. The manipulation leads to information disclosure. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-249872.

Description source: CVE List

Exploitation context

Known exploitation

VulnCheck KEV
Listed · Mar 17, 2024 · VulnCheck
Reported exploitation
Observed · VulnCheck

Available material

Repository PoCs
1
Nuclei templates
1

CISA SSVC decision

ExploitationPoC
AutomatableYes
Technical impactPartial

CISA Coordinator · SSVC 2.0.3 · Evaluated Sep 4, 2024 · Source: CVE List

Affected products and versions

2
ProductSourceVersion range

Ncast

Browse Guangzhou Yingke Electronic Technology / Ncast
CVE List2017affected

ncast

Browse ncast_project / ncast
VulnCheckVersion data not supplied

Proofs of concept

1

Repository PoCs

GitHubjidle123/cve-2024-0305expRepository PoCby jidle1231Not analyzed2 files

2.0 KiB

GitHub
PoC details

Nuclei templates

1
ProjectDiscoveryHIGHNcast busiFacade - Remote Command ExecutionCVSS 7.5

The Ncast Yingshi high-definition intelligent recording and playback system is a newly developed audio and video recording and playback system. The system has RCE vulnerabilities in versions 2017 and earlier.

Impact

Allows remote attackers to execute arbitrary code on the affected system.

Remediation

Apply the latest security patches and updates from the vendor to address this vulnerability.

AuthorsBMCel
Template tagscvecve2024ncastrcencast_projectvkevvuln
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CPE: cpe:2.3:a:ncast_project:ncast:*:*:*:*:*:*:*:*
Shodan: http.title:"高清智能录播系统"
FOFA: app="Ncast-产品" && title=="高清智能录播系统"
FOFA: title="高清智能录播系统"
FOFA: app="ncast-产品" && title=="高清智能录播系统"
Google: intitle:"高清智能录播系统"
https://cxsecurity.com/cveshow/CVE-2024-0305 https://nvd.nist.gov/vuln/detail/CVE-2024-0305 https://vuldb.com/?id.249872 https://vuldb.com/?ctiid.249872 https://github.com/Marco-zcl/POC

Source: ProjectDiscovery

References

4