How severe is CVE-2021-45039?

This vulnerability has a severity rating of CRITICAL with a CVSS score of 9.8 out of 10.

What type of vulnerability is CVE-2021-45039?

This is classified as CWE-120, which is a common weakness in software security.

CVE-2021-45039 - CRITICAL Severity | CVSS 9.8

Vulnerability Description

Multiple models of the Uniview IP Camera (e.g., IPC_G6103 B6103.16.10.B25.201218, IPC_G61, IPC21, IPC23, IPC32, IPC36, IPC62, and IPC_HCMN) offer an undocumented UDP service on port 7788 that allows a remote unauthenticated attacker to overflow an internal buffer and achieve code execution. By using this buffer overflow, a remote attacker can start the telnetd service. This service has a hardcoded default username and password (root/123456). Although it has a restrictive shell, this can be easily bypassed via the built-in ECHO shell command.

Related Vulnerabilities

CVE-2006-3100

CRITICAL

CVSS:9.8(Critical)

termpkg 3.3 suffers from buffer overflow.

CWE-1202006

CVE-2006-6024

CRITICAL

CVSS:9.8(Critical)

Multiple buffer overflows in Eudora Worldmail, possibly Worldmail 3 version 6.1.22.0, have unknown impact and attack vectors, as demonstrated by the (1) "Eudora WorldMail stack overflow" and (2) "Eudo...

CWE-1202006

CVE-2009-0948

CRITICAL

CVSS:9.8(Critical)

Multiple buffer overflows in the (1) cdf_read_sat, (2) cdf_read_long_sector_chain, and (3) cdf_read_ssat function in file before 5.02.

CWE-1202009

CVE-2009-5041

CRITICAL

CVSS:9.8(Critical)

overkill has buffer overflow via long player names that can corrupt data on the server machine

CWE-1202009

CVE-2010-1205

CRITICAL

CVSS:9.8(Critical)

Buffer overflow in pngpread.c in libpng before 1.2.44 and 1.4.x before 1.4.3, as used in progressive applications, might allow remote attackers to execute arbitrary code via a PNG image that triggers ...

CWE-1202010

CVE-2010-5333

CRITICAL

CVSS:9.8(Critical)

The web server in Integard Pro and Home before 2.0.0.9037 and 2.2.x before 2.2.0.9037 has a buffer overflow via a long password in an administration login POST request, leading to arbitrary code execu...

CWE-1202010