Latest Uniview NVR301-04S2-P4 vulnerability #
Uniview has disclosed a vulnerability in their NVR301-04S2-P4 product.
CVE-2024-3850 is rated medium with a CVSS score of 5.4 and allows an attacker to send a user a URL that if clicked on could execute malicious JavaScript in their browser.
What is the impact? #
The affected product is vulnerable to reflected cross-site scripting attack (XSS). An attacker could send a user a URL that if clicked on could execute malicious JavaScript in their browser. This vulnerability also requires authentication before it can be exploited, so the scope and severity is limited. Also, even if JavaScript is executed, no additional benefits are obtained.
Are updates or workarounds available? #
Uniview encourages users to obtain the fixed version, Uniview NVR-B3801.20.17.240507, and update. You may contact your local dealer, Uniview Service Hotline, or regional technical support for assistance.
How to find potentially vulnerable systems with runZero #
From the Asset Inventory, use the following query to locate systems running potentially vulnerable software:
product:"NVR3%"
