CVE-2023-5038 — Unauthenticated DoS

badmonkey, a Security Researcher has found a flaw that allows for a unauthenticated DoS attack on the camera. An attacker runs a crafted URL, nobody can access the web management page of the camera. and must manually restart the device or re-power it. The manufacturer has released patch firmware for the flaw, please refer to the manufacturer's report for details and workarounds.

Published Jun 25, 2024Updated Aug 2, 2024Sources: cvelistV5, Hanwha_Vision

Triage

Is it exploited, how likely is exploitation, what does it touch, and how severe do the scoring sources call it.

Exploitation

Unreported

no source claims exploitation

EPSS

chance of exploitation in 30 days

Affects

hanwha vision co

46 products listed

CVSS base

8.7

HIGH

CISA SSVC assessment

Three decision points CISA publishes for the CVEs it assesses · SSVC 2.0.3. A stakeholder decision, not a severity score.

CISA

Exploitation

None

none · proof-of-concept · active

Automatable

Yes

can an attacker script all four kill-chain steps

Technical impact

Partial

partial · total control of the vulnerable component

Affected scope

The catalog records vendors and products as separate lists, not pairs, so which product belongs to which vendor is not something this page can say.

Vendors (2)

hanwha vision co hanwhavision

Products (46)

a series q series pnm series cameraano l6012rano l6022ranv l6012rano l6082rane l6012ranv l6082rano l7082rane l7012ranv l7082rano l7012rano l7022ranv l7012rpnm c9022rvpnm 9000qbpnm 7002vdpnm 8082vtpnm 9002vqpnm 9022vpnm 9031rvpnm 9084qzpnm 9084rqzpnm 9085rqzpnm 9084qz1pnm 9084rqz1pnm 9085rqz1pnm 9322vqppnm 7082rvdpnm 12082rvdlno 6072rlnd 6012rlno 6032rlnv 6032rlnd 6022rlnd 6072rlno 6022rlnv 6012rlnv 6072rlnd 6032rlnv 6022rlno 6012rqnd 6011qnd 6012rqnd 6021qnd 6022rqnd 6032r

Every base score collected

Sources score independently and disagree; each row says who scored it and under which version.

Score	Version	Severity	Expl.	Impact	Source
8.7	CVSS 4.0	HIGH	—	—	cvelistV5

Weakness & attack patterns

CWE-703
CWE-248

References

1 on the record

www.hanwhavision.com/wp-content/uploads/2024/06/Camera-Vulnerability-Report-CVE-2023-5037-5038.pdf
vendor-advisory

Elsewhere on this site

hanwha vision coevery CVE for this vendor
hanwhavisionevery CVE for this vendor
CWE-703other pages naming this weakness

Not in any source we poll

Listed rather than left blank: an empty field and an unmeasured one look identical on screen, and only one is a reason to look elsewhere.

No confirmed IOCs, IP addresses, domains, file hashes, or malware artifacts supplied.
No organization-specific asset inventory, compensating-control status, or patch deployment evidence supplied.
No exploit packet captures, log samples, or incident case IDs supplied.