CVE-2022-37681

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2022-37681
Hitachi Kokusai Electric Newtork products for monitoring system (Camera, Decoder and Encoder) and below allows attckers to perform a directory traversal via a crafted GET request to the endpoint /ptippage.cgi. Security information ID hitachi-sec-2022-001 contains fixes for the issue.

7.5 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References
Link Resource
https://gist.github.com/Nwqda/5efea18c9142c6a966d85c6be2c0c2b5
https://www.hitachi-kokusai.co.jp/global/en/products/info/vulnerable/hitachi-sec-2022-001/index.html
Configurations

Configuration 1 (hide)

AND
cpe:2.3:o:hitachi:hc-ip9100hd_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:hitachi:hc-ip9100hd:-:*:*:*:*:*:*:*
History

07 Nov 2023, 03:49

Type Values Removed Values Added
References (MISC) https://www.hitachi-kokusai.co.jp/global/en/products/info/vulnerable/hitachi-sec-2022-001/index.html - () https://www.hitachi-kokusai.co.jp/global/en/products/info/vulnerable/hitachi-sec-2022-001/index.html -
References (MISC) https://gist.github.com/Nwqda/5efea18c9142c6a966d85c6be2c0c2b5 - Broken Link () https://gist.github.com/Nwqda/5efea18c9142c6a966d85c6be2c0c2b5 -

14 Nov 2022, 22:15

Type Values Removed Values Added
Summary Hitachi Kokusai Electric Inc ISnex HC-IP9100HD Version 1.07 and below allows attackers to perform a directory traversal via a crafted GET request to the endpoint /ptippage.cgi. Hitachi Kokusai Electric Newtork products for monitoring system (Camera, Decoder and Encoder) and below allows attckers to perform a directory traversal via a crafted GET request to the endpoint /ptippage.cgi. Security information ID hitachi-sec-2022-001 contains fixes for the issue.
References
  • {'url': 'https://www.hitachi-kokusai.co.jp/global/en/products/camera/network/index.html', 'name': 'https://www.hitachi-kokusai.co.jp/global/en/products/camera/network/index.html', 'tags': ['Vendor Advisory'], 'refsource': 'MISC'}
  • (MISC) https://www.hitachi-kokusai.co.jp/global/en/products/info/vulnerable/hitachi-sec-2022-001/index.html -

01 Sep 2022, 20:58

Type Values Removed Values Added
References (MISC) https://gist.github.com/Nwqda/5efea18c9142c6a966d85c6be2c0c2b5 - (MISC) https://gist.github.com/Nwqda/5efea18c9142c6a966d85c6be2c0c2b5 - Broken Link
References (MISC) https://www.hitachi-kokusai.co.jp/global/en/products/camera/network/index.html - (MISC) https://www.hitachi-kokusai.co.jp/global/en/products/camera/network/index.html - Vendor Advisory
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 7.5
First Time Hitachi hc-ip9100hd
Hitachi hc-ip9100hd Firmware
Hitachi
CPE cpe:2.3:o:hitachi:hc-ip9100hd_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:hitachi:hc-ip9100hd:-:*:*:*:*:*:*:*
CWE CWE-22

29 Aug 2022, 23:15

Type Values Removed Values Added
New CVE
Information

Published : 2022-08-29 23:15

Updated : 2023-12-10 14:35

NVD link : CVE-2022-37681

Mitre link : CVE-2022-37681

CVE.ORG link : CVE-2022-37681

JSON object : View

Products Affected

hitachi

  • hc-ip9100hd_firmware
  • hc-ip9100hd
CWE
CWE-22

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')