CVE-2017-14335 : On Beijing Hanbang Hanbanggaoke devices, because user-controlled input is not su

On Beijing Hanbang Hanbanggaoke devices, because user-controlled input is not sufficiently sanitized, sending a PUT request to /ISAPI/Security/users/1 allows an admin password change.

Published 2017-09-12 08:29:00

Updated 2017-09-28 14:39:49

Source MITRE

View at NVD, CVE.org

Vulnerability category: Input validation

Products affected by CVE-2017-14335

Hbgk » Hb7024xt Firmware » Version: N/A
cpe:2.3:o:hbgk:hb7024xt_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Hbgk » Hb7024xt » Version: N/A
Hbgk » Hb7032xt Firmware » Version: N/A
cpe:2.3:o:hbgk:hb7032xt_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Hbgk » Hb7032xt » Version: N/A
Hbgk » Hb7008t2 Firmware » Version: N/A
cpe:2.3:o:hbgk:hb7008t2_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Hbgk » Hb7008t2 » Version: N/A
Hbgk » Hb7016t2 Firmware » Version: N/A
cpe:2.3:o:hbgk:hb7016t2_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Hbgk » Hb7016t2 » Version: N/A
Hbgk » Hb7204xt Firmware » Version: N/A
cpe:2.3:o:hbgk:hb7204xt_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Hbgk » Hb7204xt » Version: N/A
Hbgk » Hb7208xt Firmware » Version: N/A
cpe:2.3:o:hbgk:hb7208xt_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Hbgk » Hb7208xt » Version: N/A
Hbgk » Hb7216xt Firmware » Version: N/A
cpe:2.3:o:hbgk:hb7216xt_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Hbgk » Hb7216xt » Version: N/A
Hbgk » Hb7208x3 Firmware » Version: N/A
cpe:2.3:o:hbgk:hb7208x3_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Hbgk » Hb7208x3 » Version: N/A
Hbgk » Hb7216x3 Firmware » Version: N/A
cpe:2.3:o:hbgk:hb7216x3_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Hbgk » Hb7216x3 » Version: N/A
Hbgk » Hb7204x Firmware » Version: N/A
cpe:2.3:o:hbgk:hb7204x_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Hbgk » Hb7204x » Version: N/A
Hbgk » Hb7208x Firmware » Version: N/A
cpe:2.3:o:hbgk:hb7208x_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Hbgk » Hb7208x » Version: N/A
Hbgk » Hb7216x Firmware » Version: N/A
cpe:2.3:o:hbgk:hb7216x_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Hbgk » Hb7216x » Version: N/A
Hbgk » 7204xr Firmware » Version: N/A
cpe:2.3:o:hbgk:7204xr_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Hbgk » 7204xr » Version: N/A
Hbgk » 7208xr Firmware » Version: N/A
cpe:2.3:o:hbgk:7208xr_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Hbgk » 7208xr » Version: N/A
Hbgk » 7216xr Firmware » Version: N/A
cpe:2.3:o:hbgk:7216xr_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Hbgk » 7216xr » Version: N/A
Hbgk » Hb7004k Firmware » Version: N/A
cpe:2.3:o:hbgk:hb7004k_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Hbgk » Hb7004k » Version: N/A
Hbgk » Hb7004kh Firmware » Version: N/A
cpe:2.3:o:hbgk:hb7004kh_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Hbgk » Hb7004kh » Version: N/A
Hbgk » Hb7008kc Firmware » Version: N/A
cpe:2.3:o:hbgk:hb7008kc_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Hbgk » Hb7008kc » Version: N/A
Hbgk » Hb7008kce Firmware » Version: N/A
cpe:2.3:o:hbgk:hb7008kce_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Hbgk » Hb7008kce » Version: N/A
Hbgk » Hb7008kh Firmware » Version: N/A
cpe:2.3:o:hbgk:hb7008kh_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Hbgk » Hb7008kh » Version: N/A
Hbgk » Hb7008khe Firmware » Version: N/A
cpe:2.3:o:hbgk:hb7008khe_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Hbgk » Hb7008khe » Version: N/A
Hbgk » Hb7204kl Firmware » Version: N/A
cpe:2.3:o:hbgk:hb7204kl_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Hbgk » Hb7204kl » Version: N/A
Hbgk » Hb7204kk Firmware » Version: N/A
cpe:2.3:o:hbgk:hb7204kk_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Hbgk » Hb7204kk » Version: N/A
Hbgk » Hb7016lc Firmware » Version: N/A
cpe:2.3:o:hbgk:hb7016lc_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Hbgk » Hb7016lc » Version: N/A
Hbgk » Hb7016lh Firmware » Version: N/A
cpe:2.3:o:hbgk:hb7016lh_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Hbgk » Hb7016lh » Version: N/A
Hbgk » Hb7116x3 Firmware » Version: N/A
cpe:2.3:o:hbgk:hb7116x3_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Hbgk » Hb7116x3 » Version: N/A
Hbgk » Hb7108x3 Firmware » Version: N/A
cpe:2.3:o:hbgk:hb7108x3_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Hbgk » Hb7108x3 » Version: N/A
Hbgk » Hb8004 Firmware » Version: N/A
cpe:2.3:o:hbgk:hb8004_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Hbgk » Hb8004 » Version: N/A
Hbgk » Hb8008 Firmware » Version: N/A
cpe:2.3:o:hbgk:hb8008_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Hbgk » Hb8008 » Version: N/A
Hbgk » Hb8016 Firmware » Version: N/A
cpe:2.3:o:hbgk:hb8016_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Hbgk » Hb8016 » Version: N/A
Hbgk » Hb8004r Firmware » Version: N/A
cpe:2.3:o:hbgk:hb8004r_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Hbgk » Hb8004r » Version: N/A
Hbgk » Hb8008r Firmware » Version: N/A
cpe:2.3:o:hbgk:hb8008r_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Hbgk » Hb8008r » Version: N/A
Hbgk » Hb8016r Firmware » Version: N/A
cpe:2.3:o:hbgk:hb8016r_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Hbgk » Hb8016r » Version: N/A
Hbgk » Hb8204h Firmware » Version: N/A
cpe:2.3:o:hbgk:hb8204h_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Hbgk » Hb8204h » Version: N/A
Hbgk » Hb8208h Firmware » Version: N/A
cpe:2.3:o:hbgk:hb8208h_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Hbgk » Hb8208h » Version: N/A
Hbgk » Hb8216h Firmware » Version: N/A
cpe:2.3:o:hbgk:hb8216h_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Hbgk » Hb8216h » Version: N/A
Hbgk » Hb8204hr Firmware » Version: N/A
cpe:2.3:o:hbgk:hb8204hr_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Hbgk » Hb8204hr » Version: N/A
Hbgk » Hb8208hr Firmware » Version: N/A
cpe:2.3:o:hbgk:hb8208hr_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Hbgk » Hb8208hr » Version: N/A
Hbgk » Hb8216hr Firmware » Version: N/A
cpe:2.3:o:hbgk:hb8216hr_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Hbgk » Hb8216hr » Version: N/A
Hbgk » Hb8208x3 Firmware » Version: N/A
cpe:2.3:o:hbgk:hb8208x3_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Hbgk » Hb8208x3 » Version: N/A
Hbgk » Hb8216x3 Firmware » Version: N/A
cpe:2.3:o:hbgk:hb8216x3_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Hbgk » Hb8216x3 » Version: N/A
Hbgk » Hb8608x3 Firmware » Version: N/A
cpe:2.3:o:hbgk:hb8608x3_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Hbgk » Hb8608x3 » Version: N/A
Hbgk » Hb8616x3 Firmware » Version: N/A
cpe:2.3:o:hbgk:hb8616x3_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Hbgk » Hb8616x3 » Version: N/A
Hbgk » Hb8808x3 Firmware » Version: N/A
cpe:2.3:o:hbgk:hb8808x3_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Hbgk » Hb8808x3 » Version: N/A
Hbgk » Hb8816x3 Firmware » Version: N/A
cpe:2.3:o:hbgk:hb8816x3_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Hbgk » Hb8816x3 » Version: N/A
Hbgk » Hb9404x3 Firmware » Version: N/A
cpe:2.3:o:hbgk:hb9404x3_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Hbgk » Hb9404x3 » Version: N/A
Hbgk » Hb9408x3 Firmware » Version: N/A
cpe:2.3:o:hbgk:hb9408x3_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Hbgk » Hb9408x3 » Version: N/A
Hbgk » Hb9604x3 Firmware » Version: N/A
cpe:2.3:o:hbgk:hb9604x3_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Hbgk » Hb9604x3 » Version: N/A
Hbgk » Hb9608x3 Firmware » Version: N/A
cpe:2.3:o:hbgk:hb9608x3_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Hbgk » Hb9608x3 » Version: N/A
Hbgk » Hb9012x3 Firmware » Version: N/A
cpe:2.3:o:hbgk:hb9012x3_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Hbgk » Hb9012x3 » Version: N/A
Hbgk » Hb9020x3 Firmware » Version: N/A
cpe:2.3:o:hbgk:hb9020x3_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Hbgk » Hb9020x3 » Version: N/A
Hbgk » Hb9212x3 Firmware » Version: N/A
cpe:2.3:o:hbgk:hb9212x3_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Hbgk » Hb9212x3 » Version: N/A
Hbgk » Hb9220x3 Firmware » Version: N/A
cpe:2.3:o:hbgk:hb9220x3_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Hbgk » Hb9220x3 » Version: N/A
Hbgk » Hb7904 Firmware » Version: N/A
cpe:2.3:o:hbgk:hb7904_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Hbgk » Hb7904 » Version: N/A
Hbgk » Hb7908 Firmware » Version: N/A
cpe:2.3:o:hbgk:hb7908_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Hbgk » Hb7908 » Version: N/A
Hbgk » Hb7916s Firmware » Version: N/A
cpe:2.3:o:hbgk:hb7916s_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Hbgk » Hb7916s » Version: N/A
Hbgk » Hb7904x Firmware » Version: N/A
cpe:2.3:o:hbgk:hb7904x_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Hbgk » Hb7904x » Version: N/A
Hbgk » Hb7908x Firmware » Version: N/A
cpe:2.3:o:hbgk:hb7908x_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Hbgk » Hb7908x » Version: N/A
Hbgk » Hb7916sx Firmware » Version: N/A
cpe:2.3:o:hbgk:hb7916sx_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Hbgk » Hb7916sx » Version: N/A
Hbgk » Hb9904 Firmware » Version: N/A
cpe:2.3:o:hbgk:hb9904_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Hbgk » Hb9904 » Version: N/A
Hbgk » Hb9908 Firmware » Version: N/A
cpe:2.3:o:hbgk:hb9908_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Hbgk » Hb9908 » Version: N/A
Hbgk » Hb9912 Firmware » Version: N/A
cpe:2.3:o:hbgk:hb9912_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Hbgk » Hb9912 » Version: N/A
Hbgk » Hb9916 Firmware » Version: N/A
cpe:2.3:o:hbgk:hb9916_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Hbgk » Hb9916 » Version: N/A
Hbgk » Hb9924 Firmware » Version: N/A
cpe:2.3:o:hbgk:hb9924_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Hbgk » Hb9924 » Version: N/A
Hbgk » Hb9932 Firmware » Version: N/A
cpe:2.3:o:hbgk:hb9932_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Hbgk » Hb9932 » Version: N/A
Hbgk » Hb9808n04 Firmware » Version: N/A
cpe:2.3:o:hbgk:hb9808n04_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Hbgk » Hb9808n04 » Version: N/A
Hbgk » Hb9816n08 Firmware » Version: N/A
cpe:2.3:o:hbgk:hb9816n08_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Hbgk » Hb9816n08 » Version: N/A
Hbgk » Hb9824n16 Firmware » Version: N/A
cpe:2.3:o:hbgk:hb9824n16_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Hbgk » Hb9824n16 » Version: N/A
Hbgk » Hb9832n16 Firmware » Version: N/A
cpe:2.3:o:hbgk:hb9832n16_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Hbgk » Hb9832n16 » Version: N/A

Exploit prediction scoring system (EPSS) score for CVE-2017-14335

EPSS FAQ

1.28%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 85 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2017-14335

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
5.0	MEDIUM	AV:N/AC:L/Au:N/C:N/I:P/A:N	10.0	2.9	NIST
Access Vector: Network Access Complexity: Low Authentication: None Confidentiality Impact: None Integrity Impact: Partial Availability Impact: None
7.5	HIGH	CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N	3.9	3.6	NIST
Attack Vector: Network Attack Complexity: Low Privileges Required: None User Interaction: None Scope: Unchanged Confidentiality: None Integrity: High Availability: None

CWE ids for CVE-2017-14335

CWE-20 Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

Assigned by: nvd@nist.gov (Primary)

References for CVE-2017-14335

https://blogs.securiteam.com/index.php/archives/3420

SSD Advisory – Hanbanggaoke IP Camera Arbitrary Password Change - SSD Secure Disclosure
Exploit;Third Party Advisory

Jump to

Vulnerability Details : CVE-2017-14335

Products affected by CVE-2017-14335

Exploit prediction scoring system (EPSS) score for CVE-2017-14335

CVSS scores for CVE-2017-14335

CWE ids for CVE-2017-14335

References for CVE-2017-14335