SA ID：USRC-202406-01

First Published：2024-06-14

Summary：

Reflected Cross-Site Scripting (XSS) vulnerability found in some Uniview NVR products. An attacker could send a user a URL that if clicked on could execute malicious JavaScript in their browser.

This vulnerability also requires authentication before it can be exploited, so the scope and severity is limited. Also, even if JavaScript is executed, no additional benefits are obtained.

We advise against using port forwarding and disable UPnP to avoid attacks from the Internet.

CVE ID： CVE-2024-3850

Scoring：

CVSS v3 is adopted in this vulnerability scoring（http://www.first.org/cvss/specification-document）

Base score: 5.4 (AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N)

Affected versions and fixed version:

Obtaining fixed firmware：

Please use the repair versions for update. You may contact the distribution channel, Service Hotline or regional technical support for help.

Service Hotline/regional technical support: https://global.uniview.com/About_Us/Contact_Us/

Some Uniview products have the capability of cloud upgrade. Relevant repair versions can be obtained through cloud upgrade.

Source of vulnerability information:

Thank CISA for reporting this vulnerability.

Contact Us:

Should you have any security issues or concerns with our products or solutions, please contact us at security@uniview.com.