CVE-2022-45460 is a critical stack-based buffer overflow vulnerability affecting multiple Xiongmai NVR devices, including specific MBD6304T and NBD6808T-PL firmware versions. An unauthenticated, remote attacker can exploit this by sending a crafted HTTP request with a long URI, leading to a web server crash and system reboot, or potentially arbitrary code execution. With a CVSS score of 9.8 (CRITICAL), this vulnerability poses a significant risk due to its network-based attack vector, low attack complexity, and high impact on confidentiality, integrity, and availability. While no public exploit code (Metasploit, Nuclei, ExploitDB) is currently available, there has been some community discussion indicating recent interest in this CVE, though it is not listed on CISA's KEV catalog.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
4.02.r11.c7431119.12001.130000.00000CPE matchmatch criteria | cpe:2.3:o:xiongmaitech:nbd6808t-pl_firmware:4.02.r11.c7431119.12001.130000.00000:*:*:*:*:*:*:* | ||
4.02.r11.00000117.10001.131900.00000CPE matchmatch criteria | cpe:2.3:o:xiongmaitech:mbd6304t_firmware:4.02.r11.00000117.10001.131900.00000:*:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.3 Bluesky, 0.3 Mastodon, and 2.4 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.3 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
Remediation records are not available for this CVE.