Critical severity · published Jul 2, 2024
CVE-2023-41921
Download of Code Without Integrity Check in Kiloview P1/P2 devices
9.8
CVSS
0.3%
EPSS
No
On KEV
Description
A vulnerability allows attackers to download source code or an executable from a remote location and execute the code without sufficiently verifying the origin and integrity of the code. This vulnerability can allow attackers to modify the firmware before uploading it to the system, thus achieving the modification of the target’s integrity to achieve an insecure state.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 17% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
P1
P1/P2 · Kiloview
All through 4.8.2605 · source: vendor
P4
P1 4g Video Encoder Firmware · Kiloview
0 · source: CISA
P4
P2 4g Video Encoder Firmware · Kiloview
0 · source: CISA
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2023-41921
CVE.org
https://www.cve.org/CVERecord?id=CVE-2023-41921
advisories.ncsc.nl
https://advisories.ncsc.nl/advisory?id=NCSC-2024-0273
More from P1/P2
10.0
CVE-2023-41918
Missing Authentication for Critical Function in Kiloview P1/P2 devices
10.0
CVE-2023-41917
Improper input validation in Kiloview P1/P2 devices allows for remote code execution
9.8
CVE-2023-41920
Authentication Bypass by Primary Weakness in Kiloview P1/P2 devices
9.8
CVE-2023-41919
Use of Hard-coded Credentials in Kiloview P1/P2 devices
8.8
CVE-2023-41926
Insufficiently protected credentials in Kiloview P1/P2 devices