CVE-2023-23120

MediumCVSS 5.9/10Last modified Jun 17, 2026

Description

The use of the cyclic redundancy check (CRC) algorithm for integrity check during firmware update makes TRENDnet TV-IP651WI Network Camera firmware version v1.07.01 and earlier vulnerable to firmware modification attacks. An attacker can conduct a man-in-the-middle (MITM) attack to modify the new firmware image and bypass the checksum verification.

Metrics

CVSS 3.1 5.9/10CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N

Weakness enumeration

CWE-354

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://hackmd.io/%40slASVrz_SrW7NQCsunofeA/HJl1oFzciExploit, Third Party Advisory
https://www.trendnet.com/support/Vendor Advisory
https://hackmd.io/%40slASVrz_SrW7NQCsunofeA/HJl1oFzciExploit, Third Party Advisory
https://www.trendnet.com/support/Vendor Advisory

Timeline

Published: Feb 2, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-231266.1Connectwise Automate 2022.11 is vulnerable to Clickjacking. The login screen can be iframed and used to manipulate users to perform unintend CVE-2023-231275.3In Connectwise Control 22.8.10013.8329, the login page does not implement HSTS headers therefore not enforcing HTTPS. NOTE: the vendor's pos CVE-2023-231286.1Connectwise Control 22.8.10013.8329 is vulnerable to Cross Origin Resource Sharing (CORS). The vendor's position is that two endpoints have CVE-2023-23138.8Inappropriate implementation in Sandbox in Google Chrome on Windows prior to 112.0.5615.49 allowed a remote attacker who had compromised the CVE-2023-231305.9Connectwise Automate 2022.11 is vulnerable to Cleartext authentication. Authentication is being done via HTTP (cleartext) with SSL disabled.CVE-2023-231317.5Selfwealth iOS mobile App 3.3.1 is vulnerable to Insecure App Transport Security (ATS) Settings.CVE-2023-231327.5Selfwealth iOS mobile App 3.3.1 is vulnerable to Sensitive key disclosure. The application reveals hardcoded API keys.CVE-2023-231357.2An arbitrary file upload vulnerability in Ftdms v3.1.6 allows attackers to execute arbitrary code via uploading a crafted JPG file.CVE-2023-231366.5lmxcms v1.41 was discovered to contain an arbitrary file deletion vulnerability via BackdbAction.class.php.CVE-2023-23146.5Insufficient data validation in DevTools in Google Chrome prior to 111.0.5563.64 allowed a remote attacker to bypass navigation restrictions CVE-2023-231437.8Buffer overflow vulnerability in function avc_parse_slice in file media_tools/av_parsers.c. GPAC version 2.3-DEV-rev1-g4669ba229-master.CVE-2023-231445.5Integer overflow vulnerability in function Q_DecCoordOnUnitSphere file bifs/unquantize.c in GPAC version 2.2-rev0-gab012bbfb-master.