CVE-2021-41506

Published: Jun 30, 2022Modified: Jun 17, 2026

9.8

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Exploitability: 3.9 / Impact: 5.9

Source: NVD

Description

Xiaongmai AHB7008T-MH-V2, AHB7804R-ELS, AHB7804R-MH-V2, AHB7808R-MS-V2, AHB7808R-MS, AHB7808T-MS-V2, AHB7804R-LMS, HI3518_50H10L_S39 V4.02.R11.7601.Nat.Onvif.20170420, V4.02.R11.Nat.Onvif.20160422, V4.02.R11.7601.Nat.Onvif.20170424, V4.02.R11.Nat.Onvif.20170327, V4.02.R11.Nat.Onvif.20161205, V4.02.R11.Nat.20170301, V4.02.R12.Nat.OnvifS.20170727 is affected by a backdoor in the macGuarder and dvrHelper binaries of DVR/NVR/IP camera firmware due to static root account credentials in the system.

Affected (8)

Products: Xiongmaitech: Ahb7008t Mh V2 Firmware, Ahb7804r Els Firmware, Ahb7804r Mh V2 Firmware, Ahb7808r Ms V2 Firmware, Ahb7808r Ms Firmware, Ahb7808t Ms V2 Firmware, Ahb7804r Lms Firmware, Hi3518e 50h10l S39 Firmware

Xiongmaitech

8 products

Ahb7008t Mh V2 Firmware

Ahb7804r Els Firmware

Ahb7804r Mh V2 Firmware

Ahb7808r Ms V2 Firmware

Ahb7808r Ms Firmware

Ahb7808t Ms V2 Firmware

Ahb7804r Lms Firmware

Hi3518e 50h10l S39 Firmware

Configuration A

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Xiongmaitech Ahb7008t Mh V2 Firmware	Version 4.02.r11.7601.nat.onvif.20170420

Running on/with	Platform Versions
Xiongmaitech Ahb7008t Mh V2	All versions

Configuration B

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Xiongmaitech Ahb7804r Els Firmware	Version 4.02.r11.nat.onvif.20160422

Running on/with	Platform Versions
Xiongmaitech Ahb7804r Els	All versions

Configuration C

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Xiongmaitech Ahb7804r Mh V2 Firmware	Version 4.02.r11.7601.nat.onvif.20170424

Running on/with	Platform Versions
Xiongmaitech Ahb7804r Mh V2	All versions

Configuration D

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Xiongmaitech Ahb7808r Ms V2 Firmware	Version 4.02.r11.nat.onvif.20170327

Running on/with	Platform Versions
Xiongmaitech Ahb7808r Ms V2	All versions

Configuration E

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Xiongmaitech Ahb7808r Ms Firmware	Version 4.02.r11.nat.onvif.20160328

Running on/with	Platform Versions
Xiongmaitech Ahb7808r Ms	All versions

Configuration F

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Xiongmaitech Ahb7808t Ms V2 Firmware	Version 4.02.r11.nat.onvifc.20161205

Running on/with	Platform Versions
Xiongmaitech Ahb7808t Ms V2	All versions

Configuration G

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Xiongmaitech Ahb7804r Lms Firmware	Version 4.02.r11.nat.20170301

Running on/with	Platform Versions
Xiongmaitech Ahb7804r Lms	All versions

Configuration H

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Xiongmaitech Hi3518e 50h10l S39 Firmware	Version 4.02.r12.nat.onvifs.20170727

Running on/with	Platform Versions
Xiongmaitech Hi3518e 50h10l S39	All versions

Related CWEs

CWE-287

Improper Authentication

When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.

References (8)

https://github.com/Snawoot/hisilicon-dvr-telnet

Source: cve@mitre.org

Third Party Advisory

https://github.com/tothi/hs-dvr-telnet

Source: cve@mitre.org

Third Party Advisory

https://habr.com/en/post/486856/

Source: cve@mitre.org

ExploitThird Party Advisory

https://www.xiongmaitech.com/en/index.php/news/info/12/68

Source: cve@mitre.org

Vendor Advisory

https://github.com/Snawoot/hisilicon-dvr-telnet

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

https://github.com/tothi/hs-dvr-telnet

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

https://habr.com/en/post/486856/

Source: af854a3a-2127-422b-91ae-364da2661108

ExploitThird Party Advisory

https://www.xiongmaitech.com/en/index.php/news/info/12/68

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

Timeline

No history available yet.