CVE-2022-37680

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2022-37680
An improper authentication for critical function issue in Hitachi Kokusai Electric Network products for monitoring system (Camera, Decoder and Encoder) and bellow allows attckers to remotely reboot the device via a crafted POST request to the endpoint /ptipupgrade.cgi. Security information ID hitachi-sec-2022-001 contains fixes for the issue.

7.5 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://gist.github.com/Nwqda/5efea18c9142c6a966d85c6be2c0c2b5
https://www.hitachi-kokusai.co.jp/global/en/products/info/vulnerable/hitachi-sec-2022-001/index.html
Configurations

Configuration 1 (hide)

AND
cpe:2.3:o:hitachi:hc-ip9100hd_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:hitachi:hc-ip9100hd:-:*:*:*:*:*:*:*
History

07 Nov 2023, 03:49

Type Values Removed Values Added
References (MISC) https://www.hitachi-kokusai.co.jp/global/en/products/info/vulnerable/hitachi-sec-2022-001/index.html - () https://www.hitachi-kokusai.co.jp/global/en/products/info/vulnerable/hitachi-sec-2022-001/index.html -
References (MISC) https://gist.github.com/Nwqda/5efea18c9142c6a966d85c6be2c0c2b5 - Broken Link () https://gist.github.com/Nwqda/5efea18c9142c6a966d85c6be2c0c2b5 -

08 Aug 2023, 14:22

Type Values Removed Values Added
CWE NVD-CWE-noinfo CWE-306

14 Nov 2022, 22:15

Type Values Removed Values Added
Summary An access control issue in Hitachi Kokusai Electric Inc ISnex HC-IP9100HD Version 1.07 and below allows attackers to remotely reboot the device via a crafted POST request to the endpoint /ptipupgrade.cgi. An improper authentication for critical function issue in Hitachi Kokusai Electric Network products for monitoring system (Camera, Decoder and Encoder) and bellow allows attckers to remotely reboot the device via a crafted POST request to the endpoint /ptipupgrade.cgi. Security information ID hitachi-sec-2022-001 contains fixes for the issue.
References
  • {'url': 'https://www.hitachi-kokusai.co.jp/global/en/products/camera/network/index.html', 'name': 'https://www.hitachi-kokusai.co.jp/global/en/products/camera/network/index.html', 'tags': ['Vendor Advisory'], 'refsource': 'MISC'}
  • (MISC) https://www.hitachi-kokusai.co.jp/global/en/products/info/vulnerable/hitachi-sec-2022-001/index.html -

01 Sep 2022, 21:01

Type Values Removed Values Added
CWE NVD-CWE-noinfo
CPE cpe:2.3:o:hitachi:hc-ip9100hd_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:hitachi:hc-ip9100hd:-:*:*:*:*:*:*:*
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 7.5
References (MISC) https://gist.github.com/Nwqda/5efea18c9142c6a966d85c6be2c0c2b5 - (MISC) https://gist.github.com/Nwqda/5efea18c9142c6a966d85c6be2c0c2b5 - Broken Link
References (MISC) https://www.hitachi-kokusai.co.jp/global/en/products/camera/network/index.html - (MISC) https://www.hitachi-kokusai.co.jp/global/en/products/camera/network/index.html - Vendor Advisory
First Time Hitachi hc-ip9100hd
Hitachi hc-ip9100hd Firmware
Hitachi

29 Aug 2022, 23:15

Type Values Removed Values Added
New CVE
Information

Published : 2022-08-29 23:15

Updated : 2023-12-10 14:35

NVD link : CVE-2022-37680

Mitre link : CVE-2022-37680

CVE.ORG link : CVE-2022-37680

JSON object : View

Products Affected

hitachi

  • hc-ip9100hd_firmware
  • hc-ip9100hd
CWE
CWE-306

Missing Authentication for Critical Function