CVE-2022-26259
📋 TL;DR
A buffer overflow vulnerability in Xiongmai DVR devices allows attackers to cause Denial of Service (DoS) via specially crafted RTSP requests. This affects multiple Xiongmai DVR models used in surveillance systems. Attackers can crash devices remotely without authentication.
💻 Affected Systems
- NBD80X16S-KL
- NBD80X09S-KL
- NBD80X08S-KL
- NBD80X09RA-KL
- AHB80X04R-MH
- AHB80X04R-MH-V2
- AHB80X04-R-MH-V3
- AHB80N16T-GS
- AHB80N32F4-LME
- NBD90S0VT-QW
📦 What is this software?
Ahb80n16t Gs Firmware by Xiongmaitech
Ahb80x04r Mh Firmware by Xiongmaitech
Nbd80x08s Kl Firmware by Xiongmaitech
Nbd80x09s Kl Firmware by Xiongmaitech
Nbd80x16s Kl Firmware by Xiongmaitech
Nbd90s0vt Qw Firmware by Xiongmaitech
⚠️ Risk & Real-World Impact
Worst Case
Complete device crash requiring physical reboot, permanent device damage, or potential remote code execution leading to full system compromise.
Likely Case
Device becomes unresponsive and requires manual reboot, disrupting surveillance monitoring until restored.
If Mitigated
Minimal impact if devices are behind firewalls with restricted RTSP access and have network segmentation.
🎯 Exploit Status
Public exploit details available in referenced blog posts. RTSP is unauthenticated by default on these devices.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Check vendor for specific firmware versions
Vendor Advisory: https://www.xiongmaitech.com/en/index.php/service/notice_info/51/2
Restart Required: Yes
Instructions:
1. Check vendor advisory for affected models. 2. Download latest firmware from Xiongmai support portal. 3. Upload firmware via device web interface. 4. Reboot device after update.
🔧 Temporary Workarounds
Block RTSP External Access
linuxRestrict RTSP (port 554) access to trusted networks only using firewall rules.
iptables -A INPUT -p tcp --dport 554 -s TRUSTED_NETWORK -j ACCEPT
iptables -A INPUT -p tcp --dport 554 -j DROP
Disable RTSP Service
allTurn off RTSP streaming service if not required for operations.
🧯 If You Can't Patch
- Segment DVR devices on isolated network VLAN with no internet access
- Implement network monitoring for RTSP protocol anomalies and DoS attempts
🔍 How to Verify
Check if Vulnerable:
Check device model against affected list and test with known exploit payloads in controlled environment.Check Version:
Check via device web interface under System Information or via SSH if available: cat /proc/versionVerify Fix Applied:
Verify firmware version is updated to latest from vendor and test RTSP service with malformed requests.📡 Detection & Monitoring
Log Indicators:
- Device crash/reboot logs
- RTSP service failure messages
- Memory allocation errors in system logs
Network Indicators:
- Abnormal RTSP traffic patterns
- Multiple malformed RTSP requests to port 554
- Sudden loss of device connectivity
SIEM Query:
source="firewall" dest_port=554 AND (payload_size>threshold OR pattern="malformed_rtsp")