CVE-2022-45460 PoC — Xiongmai NVR devices 缓冲区错误漏洞

Source

https://github.com/born0monday/CVE-2022-45460

Associated Vulnerability

Title: Xiongmai NVR devices 缓冲区错误漏洞 (CVE-2022-45460)
Description:Multiple Xiongmai NVR devices, including MBD6304T V4.02.R11.00000117.10001.131900.00000 and NBD6808T-PL V4.02.R11.C7431119.12001.130000.00000, allow an unauthenticated and remote user to exploit a stack-based buffer overflow and crash the web server, resulting in a system reboot. An unauthenticated and remote attacker can execute arbitrary code by sending a crafted HTTP request that triggers the overflow condition via a long URI passed to a sprintf call. NOTE: this is different than CVE-2018-10088, but this may overlap CVE-2017-16725.

Description

Proof of Concept for CVE-2022-45460

Readme

# Proof of Concept for CVE-2022-45460

Detailed write-up is available [here](https://modzero.com/en/blog/roping-our-way-to-rce/).

File Snapshot

Remarks

1. It is advised to access via the original source first.

2. Local POC snapshots are reserved for subscribers — if the original source is unavailable, the local mirror is part of the paid plan.

View subscription plans →