Vulnerability · Published Jan 3, 2023 · Assigned by twcert
CVE-2022-47618Merit Lilin Ent. Co., Ltd. AH55B04 & AH55B08 DVR - Hard-coded Credentials
Critical 9.8
In plain English
A critical-severity hard-coded credentials in AH55B04 DVR firmware from Merit Lilin Ent. Co., Ltd.. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.1% (higher than 66% of all known vulnerabilities).
Severity (CVSS 3.1)9.8Critical
Exploit odds (30 days)1.1%top 34.5% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
Merit LILIN AH55B04 & AH55B08 DVR firm has hard-coded administrator credentials. An unauthenticated remote attacker can use these credentials to log in administrator page, to manipulate system or disrupt service.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Merit Lilin Ent. Co., Ltd. | AH55B04 DVR firmware | unspecified – through SVN#7570 |
| Merit Lilin Ent. Co., Ltd. | AH55B08 DVR firmware | unspecified – through SVN#7570 |
Weakness: CWE-798 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H