CVE-2023-5037

HighCVSS 7.2/10Last modified Jun 17, 2026

Description

badmonkey, a Security Researcher has found a flaw that allows for a authenticated command injection on the camera. An attacker could inject malicious into request packets to execute command. The manufacturer has released patch firmware for the flaw, please refer to the manufacturer's report for details and workarounds.

Metrics

CVSS 3.1 7.2/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-78

Affected software

VendorProductVersions
Hanwha Vision Co., Ltd.A-Series, Q-Series, PNM-series CameraPrior to version 1.41.16;Prior to version 2.22.00;
hanwhavisionano-l6012r< 1.41.16
hanwhavisionano-l6022r< 1.41.16
hanwhavisionanv-l6012r< 1.41.16
hanwhavisionano-l6082r< 1.41.16
hanwhavisionane-l6012r< 1.41.16
hanwhavisionanv-l6082r< 1.41.16
hanwhavisionano-l7082r< 1.41.16
hanwhavisionane-l7012r< 1.41.16
hanwhavisionanv-l7082r< 1.41.16
hanwhavisionano-l7012r< 1.41.16
hanwhavisionano-l7022r< 1.41.16
hanwhavisionanv-l7012r< 1.41.16
hanwhavisionpnm-c9022rv< 2.22.02
hanwhavisionpnm-9000qb< 2.22.01
hanwhavisionpnm-7002vd< 2.22.02
hanwhavisionpnm-8082vt< 2.22.00
hanwhavisionpnm-9002vq< 2.22.02
hanwhavisionpnm-9022v< 2.22.00
hanwhavisionpnm-9031rv< 2.22.01
hanwhavisionpnm-9084qz< 2.22.02
hanwhavisionpnm-9084rqz< 2.22.02
hanwhavisionpnm-9085rqz< 2.22.02
hanwhavisionpnm-9084qz1< 2.22.02
hanwhavisionpnm-9084rqz1< 2.22.02
hanwhavisionpnm-9085rqz1< 2.22.02
hanwhavisionpnm-9322vqp< 2.22.02
hanwhavisionpnm-7082rvd< 2.22.02
hanwhavisionpnm-12082rvd< 2.22.02
hanwhavisionlno-6072r< 1.41.13
hanwhavisionlnd-6012r< 1.41.13
hanwhavisionlno-6032r< 1.41.13
hanwhavisionlnv-6032r< 1.41.13
hanwhavisionlnd-6022r< 1.41.13
hanwhavisionlnd-6072r< 1.41.13
hanwhavisionlno-6022r< 1.41.13
hanwhavisionlnv-6012r< 1.41.13
hanwhavisionlnv-6072r< 1.41.13
hanwhavisionlnd-6032r< 1.41.13
hanwhavisionlnv-6022r< 1.41.13
hanwhavisionlno-6012r< 1.41.13
hanwhavisionqnd-6011< 1.41.16
hanwhavisionqnd-6012r< 1.41.16
hanwhavisionqnd-6021< 1.41.16
hanwhavisionqnd-6022r< 1.41.16
hanwhavisionqnd-6032r< 1.41.16

References

Timeline

Published
Nov 13, 2023
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2023

CVE-2023-503705.4Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Livemesh WPBakery Page Builder Addons CVE-2023-503715.4Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Page Visit Counter Advanced Page VisitCVE-2023-503728.8Cross-Site Request Forgery (CSRF) vulnerability in Hiroaki Miyashita Custom Post Type Page Template.This issue affects Custom Post Type PageCVE-2023-503735.3Missing Authorization vulnerability in WPSAAD Alt Manager alt-manager allows Exploiting Incorrectly Configured Access Control Security LevelCVE-2023-503745.5Server-Side Request Forgery (SSRF) vulnerability in NiteoThemes CMP – Coming Soon & Maintenance.This issue affects CMP – Coming Soon & MaintCVE-2023-503755.3Missing Authorization vulnerability in edo888 Google Language Translator google-language-translator allows Exploiting Incorrectly ConfiguredCVE-2023-503766.1Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in smp7, wp.Insider Simple Membership allCVE-2023-503775.4Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in AB-WP Simple Counter allows Stored XSSCVE-2023-503786.1Lack of proper input validation and constraint enforcement in Apache Ambari prior to 2.7.8    Impact : As it will be stored XSS, Could be eCVE-2023-503798.8Malicious code injection in Apache Ambari in prior to 2.7.8. Users are recommended to upgrade to version 2.7.8, which fixes this issue. ImpCVE-2023-50387.5badmonkey, a Security Researcher has found a flaw that allows for a unauthenticated DoS attack on the camera. An attacker runs a crafted URLCVE-2023-503806.5XML External Entity injection in apache ambari versions <= 2.7.7, Users are recommended to upgrade to version 2.7.8, which fixes this issue.
CVE-2023-5037: High severity, CVSS 7.2 | Vulnix