Missing Authentication for Critical Function in Hitachi Kokusai Electric products - CVE-2022-37680

Vulnerability identifier: #VU69266

CSH Severity: Medium

CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2022-37680

CWE-ID: CWE-306

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to bypass authentication process.

The vulnerability exists due to an error in when processing authentication requests. A remote attacker can send a specially crafted request and perform a denial of service (DoS) attack.

HC-IP9100HD
HC-IP267HD(-S01)
HC-IP3050HDA(-S01)
KV-H551HDA(-S01)
HC-IP400HD(-S01)
PT-IP2500R(-S01)
PT-IP1900T(-S01)

Install update from vendor's website.

HC-IP9100HD - update to 1.08
HC-IP267HD(-S01) - update to 2.05
HC-IP3050HDA(-S01) - update to 2.05
KV-H551HDA(-S01) - update to 2.05
HC-IP400HD(-S01) - update to 2.08
PT-IP2500R(-S01) - update to 3.04
PT-IP1900T(-S01) - update to 3.05

• https://gist.github.com/Nwqda/5efea18c9142c6a966d85c6be2c0c2b5
• https://www.hitachi-kokusai.co.jp/global/en/products/camera/network/index.html

• Multiple vulnerabilities in Hitachi Kokusai Network products for monitoring system(Camera, Encoder, Decoder)