CVE-2022-45045 - CVE House
Back to Database
Status published Unknown CVE-2022-45045

Multiple Xiongmai NVR devices, including MBD6304T V4.02.R11.00000117.10001.131900.00000 and NBD6808T-PL V4.02.R11.C7431119.12001.130000.00000,...

Vulnerability Description

Multiple Xiongmai NVR devices, including MBD6304T V4.02.R11.00000117.10001.131900.00000 and NBD6808T-PL V4.02.R11.C7431119.12001.130000.00000, allow authenticated users to execute arbitrary commands as root, as exploited in the wild starting in approximately 2019. A remote and authenticated attacker, possibly using the default admin:tlJwpbo6 credentials, can connect to port 34567 and execute arbitrary operating system commands via a crafted JSON file during an upgrade request. Since at least 2021, Xiongmai has applied patches to prevent attackers from using this mechanism to execute telnetd.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2022-45045

Credits & Attribution

No credits recorded in the NVD database.

References

More from xiongmaitech

View All →
CVE-2022-45460
Multiple Xiongmai NVR devices, including MBD6304T V4.02.R11.00000117.10001.131900.00000 and NBD6808T-PL V4.02.R11.C7431119.12001.130000.00000,...
Unknown 0
CVE-2022-26259
A buffer over flow in Xiongmai DVR devices NBD80X16S-KL, NBD80X09S-KL,...
High 7.8
CVE-2021-41506
Xiaongmai AHB7008T-MH-V2, AHB7804R-ELS, AHB7804R-MH-V2, AHB7808R-MS-V2, AHB7808R-MS, AHB7808T-MS-V2, AHB7804R-LMS, HI3518_50H10L_S39 V4.02.R11.7601.Nat.Onvif.20170420,...
Critical 9.8
CVE-2021-38828
Xiongmai Camera XM-JPR2-LX V4.02.R12.A6420987.10002.147502.00000 is vulnerable to plain-text traffic sniffing....
Unknown 0
CVE-2021-38827
Xiongmai Camera XM-JPR2-LX V4.02.R12.A6420987.10002.147502.00000 is vulnerable to account takeover....
Unknown 0

Affected Vendor

xiongmaitech

View all reports →

Affected Software

mbd6304t, nbd6808t-pl, nbd7004t-p, nbd7008t-p, nbd7016t-f-v2, nbd7024h-p, nbd7024t-p, nbd7804r-f\(ep\), nbd7804r-f\(hdmi\), nbd7804r-fw, nbd7804t-pl, nbd7808r-pl\(ep\), nbd7808r-pl\(hdmi\), nbd7808t-pl, nbd7904r-fs, nbd7904t-p, nbd7904t-pl, nbd7904t-pl-xpoe, nbd7904t-plc-xpoe, nbd7904t-q, nbd7908t-q, nbd8004r-pl\(ep\), nbd8004r-yl\(ep\), nbd8004t-q, nbd8008r-pl, nbd8008r-pl\(ep\), nbd8008r-yl\(ep\), nbd8008ra-gl, nbd8008ra-glk, nbd8008ra-ul\(ep\), nbd8008ra-ula, nbd8008ra-ulk, nbd8008t-q, nbd8009s-ula-v2, nbd8010s-kl-v2, nbd8016r-ul, nbd8016ra-k\(ep\), nbd8016ra-ul, nbd8016ra-ul\(ep\), nbd8016ra-ula, nbd8016ra-ulk, nbd8016s-kl-v2, nbd8016s-ula-v2, nbd8016t-q-v2, nbd8025r-ul, nbd8032h4-p, nbd8032h4-q, nbd8032h4-qe, nbd8032h4-ul, nbd8032h8-p, nbd8032h8-qe, nbd8032ra-ul-v2, nbd8064h8-p, nbd80n16ra-kl, nbd80n16ra-kl\(ep\), nbd80s08s-kl\(ep\), nbd80s10s-kl, nbd80s16s-kl, nbd80s16s-kl\(ep\), nbd80x09ra-kl, nbd80x09s-kl, nbd88x09s-kl, nbd8904r-pl, nbd8904r-yl, nbd8904t-gsc-xpoe, nbd8904t-q, nbd8908r-pl, nbd8908r-yl, nbd8908t-pl-xpoe, nbd8908t-plc-xpoe, nbd8916f4-q, nbd8916f8-q, mbd6304t firmware, nbd6808t-pl firmware, nbd7004t-p firmware, nbd7008t-p firmware, nbd7016t-f-v2 firmware, nbd7024h-p firmware, nbd7024t-p firmware, nbd7804r-f\(ep\) firmware, nbd7804r-f\(hdmi\) firmware, nbd7804r-fw firmware, nbd7804t-pl firmware, nbd7808r-pl\(ep\) firmware, nbd7808r-pl\(hdmi\) firmware, nbd7808t-pl firmware, nbd7904r-fs firmware, nbd7904t-p firmware, nbd7904t-pl firmware, nbd7904t-pl-xpoe firmware, nbd7904t-plc-xpoe firmware, nbd7904t-q firmware, nbd7908t-q firmware, nbd8004r-pl\(ep\) firmware, nbd8004r-yl\(ep\) firmware, nbd8004t-q firmware, nbd8008r-pl firmware, nbd8008r-pl\(ep\) firmware, nbd8008r-yl\(ep\) firmware, nbd8008ra-gl firmware, nbd8008ra-glk firmware, nbd8008ra-ul\(ep\) firmware, nbd8008ra-ula firmware, nbd8008ra-ulk firmware, nbd8008t-q firmware, nbd8009s-ula-v2 firmware, nbd8010s-kl-v2 firmware, nbd8016r-ul firmware, nbd8016ra-k\(ep\) firmware, nbd8016ra-ul firmware, nbd8016ra-ul\(ep\) firmware, nbd8016ra-ula firmware, nbd8016ra-ulk firmware, nbd8016s-kl-v2 firmware, nbd8016s-ula-v2 firmware, nbd8016t-q-v2 firmware, nbd8025r-ul firmware, nbd8032h4-p firmware, nbd8032h4-q firmware, nbd8032h4-qe firmware, nbd8032h4-ul firmware, nbd8032h8-p firmware, nbd8032h8-qe firmware, nbd8032ra-ul-v2 firmware, nbd8064h8-p firmware, nbd80n16ra-kl firmware, nbd80n16ra-kl\(ep\) firmware, nbd80s08s-kl\(ep\) firmware, nbd80s10s-kl firmware, nbd80s16s-kl firmware, nbd80s16s-kl\(ep\) firmware, nbd80x09ra-kl firmware, nbd80x09s-kl firmware, nbd88x09s-kl firmware, nbd8904r-pl firmware, nbd8904r-yl firmware, nbd8904t-gsc-xpoe firmware, nbd8904t-q firmware, nbd8908r-pl firmware, nbd8908r-yl firmware, nbd8908t-pl-xpoe firmware, nbd8908t-plc-xpoe firmware, nbd8916f4-q firmware, nbd8916f8-q firmware
Vulnerable Versions:
4.02.r11.00000117.10001.131900.00000, 4.02.r11.c7431119.12001.130000.00000

Timeline

Official Publish: December 1st, 2022
Last Modified: April 24th, 2025
Added to House: July 21st, 2026

CVSS Vectors

No vector data available

Weaknesses (CWE)

No CWE data available

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.