title: Information Disclosure Vulnerability in CP-Plus Network Video Recorder
description: The vulnerability exists in CP-Plus NVR due to an improper input handling at the web-based management interface of the affected product. An unauthenticated remote attacker could exploit this vulnerability by sending specially crafted HTTP requests to the vulnerable device.
Successful exploitation of this vulnerability could allow the remote attacker to obtain sensitive information on the targeted device.
problem types: CWE-200 Exposure of Sensitive Information to an Unauthorized Actor
affected:
{
vendor: Aditya Infotech Limited
product: CP-VNR-3104, CP-VNR-3108, CP-VNR-3208
versions:
status: affected, version: 0, lessThan: B3223P22C02424, versionType: custom
defaultStatus: unaffected
}
metrics:
format: CVSS
scenarios: GENERAL
cvssV3_1: [
version: 3.1
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: NONE
availabilityImpact: NONE
baseSeverity: HIGH
baseScore: 7.5
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
]
solutions: Upgrade to the latest firmware B3223P22C02424
https://www.cpplusworld.com/prodassets/firmware/e6428409-e921-4d02-ab19-d35d05aee380.bin https://www.cpplusworld.com/prodassets/firmware/e6428409-e921-4d02-ab19-d35d05aee380.bin