CVE-2020-15956
📋 TL;DR
CVE-2020-15956 is a buffer overflow vulnerability in ACTi NVR3 Standard Server that allows remote unauthenticated attackers to crash the application via a malformed payload. This affects organizations using ACTi NVR3 Standard Server 3.0.12.42 for video surveillance systems.
💻 Affected Systems
- ACTi NVR3 Standard Server
📦 What is this software?
Nvr by Acti
Nvr by Acti
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution leading to complete system compromise, though only denial of service has been demonstrated publicly.
Likely Case
Remote denial of service causing video surveillance system downtime and loss of monitoring capability.
If Mitigated
Limited to application crash without system compromise if proper network segmentation and monitoring are in place.
🎯 Exploit Status
Public proof-of-concept code exists that demonstrates reliable denial of service. The exploit requires no authentication and minimal technical skill to execute.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 3.0.12.43 or later
Vendor Advisory: https://www2.acti.com/nvr3
Restart Required: Yes
Instructions:
1. Download latest version from ACTi website. 2. Backup configuration. 3. Stop NVR3 service. 4. Install update. 5. Restart service and verify functionality.
🔧 Temporary Workarounds
Network Segmentation
allRestrict network access to NVR3 server to only trusted management and camera networks
Use firewall rules to block external access to port 80/443 and other NVR3 ports
Service Restart Automation
windowsConfigure automatic service restart to minimize downtime from DoS attacks
sc failure "ACTi NVR3 Service" reset= 86400 actions= restart/60000/restart/120000
🧯 If You Can't Patch
- Implement strict network access controls to limit who can reach the NVR3 server
- Deploy intrusion detection systems to monitor for exploitation attempts and alert on service crashes
🔍 How to Verify
Check if Vulnerable:
Check if ActiveMediaServer.exe version is 3.0.12.42 via file properties or running 'wmic process where name="ActiveMediaServer.exe" get ExecutablePath'Check Version:
wmic datafile where name="C:\\Program Files (x86)\\ACTi Corporation\\NVR3 Standard\\ActiveMediaServer.exe" get versionVerify Fix Applied:
Verify ActiveMediaServer.exe version is 3.0.12.43 or higher and test with known exploit payloads📡 Detection & Monitoring
Log Indicators:
- Application crash logs for ActiveMediaServer.exe
- Windows Event Logs showing service termination (Event ID 7034)
Network Indicators:
- Unusual traffic patterns to NVR3 server port 80/443 with malformed payloads
- Multiple connection attempts followed by service unavailability
SIEM Query:
source="windows" AND (event_id=7034 AND process_name="ActiveMediaServer.exe") OR (event_id=1000 AND faulting_module="ActiveMediaServer.exe")🔗 References
- http://packetstormsecurity.com/files/158771/ACTi-NVR3-Standard-Professional-Server-3.0.12.42-Denial-Of-Service.html
- https://github.com/megamagnus/cve-2020-15956
- https://www2.acti.com/nvr3
- http://packetstormsecurity.com/files/158771/ACTi-NVR3-Standard-Professional-Server-3.0.12.42-Denial-Of-Service.html
- https://github.com/megamagnus/cve-2020-15956
- https://www2.acti.com/nvr3
