CVE-2023-22375
📋 TL;DR
This CSRF vulnerability in Planex CS-WMV02G network cameras allows attackers to trick authenticated users into performing unauthorized actions by viewing malicious web pages. It affects all versions of these specific wired/wireless cameras, but only impacts products no longer supported by the manufacturer.
💻 Affected Systems
- Planex CS-WMV02G Wired/Wireless LAN Pan/Tilt Network Camera
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete device compromise allowing camera control, configuration changes, firmware modification, or integration into botnets.
Likely Case
Unauthorized camera movement, settings modification, or disruption of surveillance functionality.
If Mitigated
Limited impact if cameras are isolated from user browsing activities and internet access.
🎯 Exploit Status
Exploitation requires social engineering to make authenticated users visit malicious pages. No authentication bypass needed.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: None
Vendor Advisory: https://www.planex.co.jp/support/support_end_list.shtml
Restart Required: No
Instructions:
No official patch available. Product is end-of-life. Replace with supported hardware.
🔧 Temporary Workarounds
Network Segmentation
allIsolate cameras on separate VLAN without internet access
Browser Protection
allUse CSRF protection browser extensions and disable automatic form submission
🧯 If You Can't Patch
- Decommission and replace with supported network cameras
- Implement strict network segmentation and firewall rules to prevent camera web interface access from general user networks
🔍 How to Verify
Check if Vulnerable:
Check device model against affected products list. All CS-WMV02G cameras are vulnerable.Check Version:
Check camera web interface or physical label for CS-WMV02G model identificationVerify Fix Applied:
No fix available. Verify replacement with supported hardware.📡 Detection & Monitoring
Log Indicators:
- Unexpected configuration changes
- Camera movement without operator input
- Multiple failed login attempts followed by successful changes
Network Indicators:
- HTTP POST requests to camera from unexpected sources
- Cross-origin requests to camera web interface
SIEM Query:
source_ip IN (user_workstations) AND dest_ip IN (camera_ips) AND http_method = POST AND user_agent CONTAINS malicious_domain