CVE-2023-43271

CriticalCVSS 9.1/10Last modified Jun 17, 2026

Description

Incorrect access control in 70mai a500s v1.2.119 allows attackers to directly access and delete the video files of the driving recorder through ftp and other protocols.

Metrics

CVSS 3.1 9.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Weakness enumeration

CWE-306

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://github.com/Question-h/vuln/blob/master/70mai_a500s_backdoor.mdExploit, Third Party Advisory
https://github.com/Question-h/vuln/blob/master/CVE-2023-43271.mdThird Party Advisory
https://github.com/Question-h/vuln/blob/master/70mai_a500s_backdoor.mdExploit, Third Party Advisory
https://github.com/Question-h/vuln/blob/master/CVE-2023-43271.mdThird Party Advisory

Timeline

Published: Oct 9, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-432747.5Phpjabbers PHP Shopping Cart 4.2 is vulnerable to SQL Injection via the id parameter.CVE-2023-432758.8Cross-Site Request Forgery (CSRF) vulnerability in DedeCMS v5.7 in 110 backend management interface via /catalog_add.php, allows attackers t CVE-2023-432788.8A Cross-Site Request Forgery (CSRF) in admin_manager.php of Seacms up to v12.8 allows attackers to arbitrarily add an admin account.CVE-2023-432796.5Null Pointer Dereference in mask_cidr6 component at cidr.c in Tcpreplay 4.4.4 allows attackers to crash the application via crafted tcprewri CVE-2023-43285.5Broadcom RAID Controller web interface is vulnerable to exposure of sensitive data and the keys used for encryption are accessible to any l CVE-2023-432816.5Double Free vulnerability in Nothings Stb Image.h v.2.28 allows a remote attacker to cause a denial of service via a crafted file to the stb CVE-2023-432848.8D-Link Wireless MU-MIMO Gigabit AC1200 Router DIR-846 100A53DBR-Retail devices allow an authenticated remote attacker to execute arbitrary c CVE-2023-43299.8Broadcom RAID Controller web interface is vulnerable due to insecure default of HTTP configuration that does not safeguard SESSIONID cookie CVE-2023-432919.8Deserialization of Untrusted Data in emlog pro v.2.1.15 and earlier allows a remote attacker to execute arbitrary code via the cache.php com CVE-2023-432926.1Cross Site Scripting vulnerability in My Food Recipe Using PHP with Source Code v.1.0 allows a local attacker to execute arbitrary code via CVE-2023-432953.5Cross Site Request Forgery vulnerability in Click Studios (SA) Pty Ltd Passwordstate v.Build 9785 and before allows a local attacker to exec CVE-2023-432975.4An issue in animal-art-lab v13.6.1 allows attackers to send crafted notifications via leakage of the channel access token.