Vulnerability · Published Apr 15, 2020 · Assigned by twcert
CVE-2020-10514iCatch DVR - Command Injection
High 8.8
In plain English
A high-severity security flaw in DVR firmware from iCatch Inc.. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.6% (higher than 76% of all known vulnerabilities).
Severity (CVSS 3.1)8.8High
Exploit odds (30 days)1.6%top 24.3% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
iCatch DVR firmware before 20200103 do not validate function parameter properly, resulting attackers executing arbitrary command.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| iCatch Inc. | DVR firmware | before 20200103 |
References
- https://www.chtsecurity.com/news/008fcbe8-198e-4c21-9417-5ba79a6b0e7d x_refsource_CONFIRM
- https://www.twcert.org.tw/tw/cp-132-3534-fc7f5-1.html x_refsource_CONFIRM