CVE-2023-30466
📋 TL;DR
This vulnerability allows remote attackers to take over administrator accounts on Milesight NVR devices through a weak password reset mechanism in the web interface. Attackers can exploit this by sending specially crafted HTTP requests to vulnerable devices. All Milesight 4K/H.265 Series NVR models with affected firmware versions are impacted.
💻 Affected Systems
- Milesight 4K/H.265 Series NVR models: MS-Nxxxx-xxG, MS-Nxxxx-xxE, MS-Nxxxx-xxT, MS-Nxxxx-xxH, MS-Nxxxx-xxC
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete compromise of the NVR system, allowing attackers to view/delete surveillance footage, reconfigure cameras, disable security systems, and potentially pivot to other network systems.
Likely Case
Account takeover leading to unauthorized access to surveillance systems, footage manipulation, and disruption of security monitoring.
If Mitigated
Limited impact if devices are behind firewalls with restricted web interface access and strong network segmentation.
🎯 Exploit Status
Exploitation requires sending specially crafted HTTP requests to the web interface. No authentication needed.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Check Milesight security advisory for specific patched firmware versions
Vendor Advisory: https://www.milesight.com/security/
Restart Required: Yes
Instructions:
1. Check current firmware version on NVR. 2. Download latest firmware from Milesight support portal. 3. Upload firmware via web interface. 4. Reboot device after installation.
🔧 Temporary Workarounds
Network Isolation
allRestrict access to NVR web interface using firewall rules
Disable Web Interface
allDisable web-based management if not required
🧯 If You Can't Patch
- Place NVR devices behind firewalls with strict inbound rules blocking all external access to web interface
- Implement network segmentation to isolate NVR systems from general network traffic
🔍 How to Verify
Check if Vulnerable:
Check if device is one of the affected models and has web interface accessible. Test password reset functionality for weaknesses.Check Version:
Login to NVR web interface and check System Information > Firmware VersionVerify Fix Applied:
Verify firmware version is updated to latest release from Milesight. Test password reset functionality to confirm it requires proper authentication.📡 Detection & Monitoring
Log Indicators:
- Multiple failed password reset attempts
- Successful password reset from unusual IP addresses
- Administrator account changes from unexpected sources
Network Indicators:
- HTTP POST requests to password reset endpoints from external IPs
- Unusual traffic patterns to NVR web interface
SIEM Query:
source_ip=external AND dest_port=80|443 AND uri_path CONTAINS 'password' OR 'reset' AND dest_ip=NVR_IP