CVE-2022-45045

PoC —

CVSS 3.1

8.8 high

EPSS

1%p68

Published

Dec 1, 2022 (Dec 1, 2022)

Modified

Jun 17, 2026

Description

Multiple Xiongmai NVR devices, including MBD6304T V4.02.R11.00000117.10001.131900.00000 and NBD6808T-PL V4.02.R11.C7431119.12001.130000.00000, allow authenticated users to execute arbitrary commands as root, as exploited in the wild starting in approximately 2019. A remote and authenticated attacker, possibly using the default admin:tlJwpbo6 credentials, can connect to port 34567 and execute arbitrary operating system commands via a crafted JSON file during an upgrade request. Since at least 2021, Xiongmai has applied patches to prevent attackers from using this mechanism to execute telnetd.

Vendors: xiongmaitech
Products: mbd6304t, nbd6808t-pl, nbd7004t-p, nbd7008t-p, nbd7016t-f-v2, nbd7024h-p, nbd7024t-p, nbd7804r-f\(ep\), nbd7804r-f\(hdmi\), nbd7804r-fw, nbd7804t-pl, nbd7808r-pl\(ep\)
Weakness: CWE-78
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

NVD CVE.org GitHub PoCs EPSS (1.3%)

In the news0 stories

No ingested article mentions this CVE yet.