CVE-2021-41506
published 2022-06-30CVE-2021-41506: Xiaongmai AHB7008T-MH-V2, AHB7804R-ELS, AHB7804R-MH-V2, AHB7808R-MS-V2, AHB7808R-MS, AHB7808T-MS-V2, AHB7804R-LMS, HI3518_50H10L_S39…
PriorityP181critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
ITWVulnCheck KEV
Exploited in the wild
EPSS
2.11%
79.4th percentile
Xiaongmai AHB7008T-MH-V2, AHB7804R-ELS, AHB7804R-MH-V2, AHB7808R-MS-V2, AHB7808R-MS, AHB7808T-MS-V2, AHB7804R-LMS, HI3518_50H10L_S39 V4.02.R11.7601.Nat.Onvif.20170420, V4.02.R11.Nat.Onvif.20160422, V4.02.R11.7601.Nat.Onvif.20170424, V4.02.R11.Nat.Onvif.20170327, V4.02.R11.Nat.Onvif.20161205, V4.02.R11.Nat.20170301, V4.02.R12.Nat.OnvifS.20170727 is affected by a backdoor in the macGuarder and dvrHelper binaries of DVR/NVR/IP camera firmware due to static root account credentials in the system.
Affected
8 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| xiongmaitech | ahb7008t-mh-v2_firmware | — | — |
| xiongmaitech | ahb7804r-els_firmware | — | — |
| xiongmaitech | ahb7804r-lms_firmware | — | — |
| xiongmaitech | ahb7804r-mh-v2_firmware | — | — |
| xiongmaitech | ahb7808r-ms-v2_firmware | — | — |
| xiongmaitech | ahb7808r-ms_firmware | — | — |
| xiongmaitech | ahb7808t-ms-v2_firmware | — | — |
| xiongmaitech | hi3518e_50h10l_s39_firmware | — | — |
CVSS provenance
nvdv3.19.8CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
nvdv2.010.0CRITICALAV:N/AC:L/Au:N/C:C/I:C/A:C
vulncheck9.8CRITICAL
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-6q5r-54qp-4cp9: Xiaongmai AHB7008T-MH-V2, AHB7804R-ELS, AHB7804R-MH-V2, AHB7808R-MS-V2, AHB7808R-MS, AHB7808T-MS-V2, AHB7804R-LMS, HI3518_50H10L_S39 V4
ghsa_unreviewed·2022-07-01
CVE-2021-41506 [CRITICAL] CWE-522 GHSA-6q5r-54qp-4cp9: Xiaongmai AHB7008T-MH-V2, AHB7804R-ELS, AHB7804R-MH-V2, AHB7808R-MS-V2, AHB7808R-MS, AHB7808T-MS-V2, AHB7804R-LMS, HI3518_50H10L_S39 V4
Xiaongmai AHB7008T-MH-V2, AHB7804R-ELS, AHB7804R-MH-V2, AHB7808R-MS-V2, AHB7808R-MS, AHB7808T-MS-V2, AHB7804R-LMS, HI3518_50H10L_S39 V4.02.R11.7601.Nat.Onvif.20170420, V4.02.R11.Nat.Onvif.20160422, V4.02.R11.7601.Nat.Onvif.20170424, V4.02.R11.Nat.Onvif.20170327, V4.02.R11.Nat.Onvif.20161205, V4.02.R11.Nat.20170301, V4.02.R12.Nat.OnvifS.20170727 is affected by a backdoor in the macGuarder and dvrHelper binaries of DVR/NVR/IP camera firmware due to static root account credentials in the system.
VulnCheck
xiongmaitech ahb7008t-mh-v2_firmware Improper Authentication
vulncheck·2021·CVSS 9.8
CVE-2021-41506 [CRITICAL] xiongmaitech ahb7008t-mh-v2_firmware Improper Authentication
xiongmaitech ahb7008t-mh-v2_firmware Improper Authentication
Xiaongmai AHB7008T-MH-V2, AHB7804R-ELS, AHB7804R-MH-V2, AHB7808R-MS-V2, AHB7808R-MS, AHB7808T-MS-V2, AHB7804R-LMS, HI3518_50H10L_S39 V4.02.R11.7601.Nat.Onvif.20170420, V4.02.R11.Nat.Onvif.20160422, V4.02.R11.7601.Nat.Onvif.20170424, V4.02.R11.Nat.Onvif.20170327, V4.02.R11.Nat.Onvif.20161205, V4.02.R11.Nat.20170301, V4.02.R12.Nat.OnvifS.20170727 is affected by a backdoor in the macGuarder and dvrHelper binaries of DVR/NVR/IP camera firmware due to static root account credentials in the system.
Affected: xiongmaitech ahb7008t-mh-v2_firmware
Required Action: Apply remediations or mitigations per vendor instructions or discontinue use of the product if remediation or mitigations are unavailable.
Exploitation References: https://w
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
https://github.com/Snawoot/hisilicon-dvr-telnethttps://github.com/tothi/hs-dvr-telnethttps://habr.com/en/post/486856/https://www.xiongmaitech.com/en/index.php/news/info/12/68https://github.com/Snawoot/hisilicon-dvr-telnethttps://github.com/tothi/hs-dvr-telnethttps://habr.com/en/post/486856/https://www.xiongmaitech.com/en/index.php/news/info/12/68
2022-06-30
Published
Exploited in the wild