Critical severity · published Jul 2, 2024
CVE-2023-41918
Missing Authentication for Critical Function in Kiloview P1/P2 devices
10.0
CVSS
0.6%
EPSS
No
On KEV
Description
A vulnerability allows unauthorized access to functionality inadequately constrained by ACLs. Attackers may exploit this to unauthenticated execute commands potentially leading to unauthorized data manipulation, access to privileged functions, or even the execution of arbitrary code.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.6% · higher than 47% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
P1
P1/P2 · Kiloview
All through 4.8.2605 · source: vendor
P4
P1 4g Video Encoder Firmware · Kiloview
0 · source: CISA
P4
P2 4g Video Encoder Firmware · Kiloview
0 · source: CISA
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2023-41918
CVE.org
https://www.cve.org/CVERecord?id=CVE-2023-41918
advisories.ncsc.nl
https://advisories.ncsc.nl/advisory?id=NCSC-2024-0273
More from P1/P2
10.0
CVE-2023-41917
Improper input validation in Kiloview P1/P2 devices allows for remote code execution
9.8
CVE-2023-41921
Download of Code Without Integrity Check in Kiloview P1/P2 devices
9.8
CVE-2023-41920
Authentication Bypass by Primary Weakness in Kiloview P1/P2 devices
9.8
CVE-2023-41919
Use of Hard-coded Credentials in Kiloview P1/P2 devices
8.8
CVE-2023-41926
Insufficiently protected credentials in Kiloview P1/P2 devices