by Kastro
Paper/Archive/CVE-2023-41921

CVE-2023-41921

Kiloview P1/P2 — Download of Code Without Integrity Check in Kiloview P1/P2 devices

EPSS 0.3%CVSS 9.8
critical.is priorityof 100
33
CVSS 9.8 (CNA)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 16.9.169 × 203.4No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

A vulnerability allows attackers to download source code or an executable from a remote location and execute the code without sufficiently verifying the origin and integrity of the code. This vulnerability can allow attackers to modify the firmware before uploading it to the system, thus achieving the modification of the target’s integrity to achieve an insecure state.

Affected

ProductAffectedFixed inSource
P1/P2All – 4.8.2605–CNA
p1_4g_video_encoder_firmware≤ *–CISA-ADP
p2_4g_video_encoder_firmware≤ *–CISA-ADP

Scores by source

NCSC-NL (CNA)9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

refadvisories.ncsc.nl/advisory?id=NCSC-2024-0273