CVE-2024-5631

Description

Longse NVR (Network Video Recorder) model NVR3608PGE2W, as well as products based on this device, are transmitting user's login and password to a remote control service without using any encryption. This enables an on-path attacker to eavesdrop the credentials and subsequently obtain access to the video stream. The credentials are being sent when a user decides to change his password in router's portal.

PUBLISHED Reserved 2024-06-04 | Published 2024-07-09 | Updated 2024-08-01 | Assigner CERT-PL

Problem types

CWE-319 Cleartext Transmission of Sensitive Information

Product status

Credits

Adam Zambrzycki finder

References

zamel.com/...aw-monitoringu-bezprzewodowego-wi-fi-typ-zmb-01 product

cert.pl/en/posts/2024/07/CVE-2024-5631/ third-party-advisory

cert.pl/posts/2024/07/CVE-2024-5631 third-party-advisory

zamel.com/...aw-monitoringu-bezprzewodowego-wi-fi-typ-zmb-01 product

cert.pl/en/posts/2024/07/CVE-2024-5631/ third-party-advisory

cert.pl/posts/2024/07/CVE-2024-5631 third-party-advisory

cve.org (CVE-2024-5631)

nvd.nist.gov (CVE-2024-5631)

Download JSON