CVE-2023-5038

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

badmonkey, a Security Researcher has found a flaw that allows for a unauthenticated DoS attack on the camera. An attacker runs a crafted URL, nobody can access the web management page of the camera. and must manually restart the device or re-power it. The manufacturer has released patch firmware for the flaw, please refer to the manufacturer's report for details and workarounds.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-248CWE-703

Affected software

VendorProductVersions
Hanwha Vision Co., Ltd.A-Series, Q-Series, PNM-series CameraPrior to version 1.41.16, Prior to version 2.22.00
hanwhavisionano-l6012r< 1.41.16
hanwhavisionano-l6022r< 1.41.16
hanwhavisionanv-l6012r< 1.41.16
hanwhavisionano-l6082r< 1.41.16
hanwhavisionane-l6012r< 1.41.16
hanwhavisionanv-l6082r< 1.41.16
hanwhavisionano-l7082r< 1.41.16
hanwhavisionane-l7012r< 1.41.16
hanwhavisionanv-l7082r< 1.41.16
hanwhavisionano-l7012r< 1.41.16
hanwhavisionano-l7022r< 1.41.16
hanwhavisionanv-l7012r< 1.41.16
hanwhavisionpnm-c9022rv< 2.22.02
hanwhavisionpnm-9000qb< 2.22.01
hanwhavisionpnm-7002vd< 2.22.02
hanwhavisionpnm-8082vt< 2.22.00
hanwhavisionpnm-9002vq< 2.22.02
hanwhavisionpnm-9022v< 2.22.00
hanwhavisionpnm-9031rv< 2.22.01
hanwhavisionpnm-9084qz< 2.22.02
hanwhavisionpnm-9084rqz< 2.22.02
hanwhavisionpnm-9085rqz< 2.22.02
hanwhavisionpnm-9084qz1< 2.22.02
hanwhavisionpnm-9084rqz1< 2.22.02
hanwhavisionpnm-9085rqz1< 2.22.02
hanwhavisionpnm-9322vqp< 2.22.02
hanwhavisionpnm-7082rvd< 2.22.02
hanwhavisionpnm-12082rvd< 2.22.02
hanwhavisionlno-6072r< 1.41.13
hanwhavisionlnd-6012r< 1.41.13
hanwhavisionlno-6032r< 1.41.13
hanwhavisionlnv-6032r< 1.41.13
hanwhavisionlnd-6022r< 1.41.13
hanwhavisionlnd-6072r< 1.41.13
hanwhavisionlno-6022r< 1.41.13
hanwhavisionlnv-6012r< 1.41.13
hanwhavisionlnv-6072r< 1.41.13
hanwhavisionlnd-6032r< 1.41.13
hanwhavisionlnv-6022r< 1.41.13
hanwhavisionlno-6012r< 1.41.13
hanwhavisionqnd-6011< 1.41.16
hanwhavisionqnd-6012r< 1.41.16
hanwhavisionqnd-6021< 1.41.16
hanwhavisionqnd-6022r< 1.41.16
hanwhavisionqnd-6032r< 1.41.16
hanwhavisionano-l6012r< 1.41.16
hanwhavisionano-l6022r< 1.41.16
hanwhavisionanv-l6012r< 1.41.16
hanwhavisionano-l6082r< 1.41.16

References

Timeline

Published
Jun 25, 2024
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2023

CVE-2023-503806.5XML External Entity injection in apache ambari versions <= 2.7.7, Users are recommended to upgrade to version 2.7.8, which fixes this issue.CVE-2023-503817.2Three os command injection vulnerabilities exist in the boa formWsc functionality of Realtek rtl819x Jungle SDK v3.4.11. A specially craftedCVE-2023-503827.2Three os command injection vulnerabilities exist in the boa formWsc functionality of Realtek rtl819x Jungle SDK v3.4.11. A specially craftedCVE-2023-503837.2Three os command injection vulnerabilities exist in the boa formWsc functionality of Realtek rtl819x Jungle SDK v3.4.11. A specially craftedCVE-2023-503868.8Improper Control of Dynamically-Managed Code Resources, Unrestricted Upload of File with Dangerous Type, Inclusion of Functionality from UntCVE-2023-503877.5Certain DNSSEC aspects of the DNS protocol (in RFC 4033, 4034, 4035, 6840, and related RFCs) allow remote attackers to cause a denial of serCVE-2023-503958.0SQL Injection Remote Code Execution Vulnerability was found using an update statement in the SolarWinds Platform. This vulnerability requireCVE-2023-50418.8The Track The Click WordPress plugin before 0.3.12 does not properly sanitize query parameters to the stats REST endpoint before using them CVE-2023-50427.5Sensitive information disclosure due to insecure folder permissions. The following products are affected: Acronis Cyber Protect Home Office CVE-2023-504229.8SAP BTP Security Services Integration Library ([Java] cloud-security-services-integration-library) - versions below 2.17.0 and versions fromCVE-2023-504239.8SAP BTP Security Services Integration Library ([Python] sap-xssec) - versions < 4.1.0, allow under certain conditions an escalation of priviCVE-2023-504249.8SAP BTP Security Services Integration Library ([Golang] github.com/sap/cloud-security-client-go) - versions < 0.17.0, allow under certain co
CVE-2023-5038: High severity, CVSS 7.5 | Vulnix