CVE-2023-30466 - CVE House
Back to Database
Status published Critical CVE-2023-30466

Authentication Bypass Vulnerability in Milesight Network Video Recorder (NVR)

Vulnerability Description

This vulnerability exists in Milesight 4K/H.265 Series NVR models (MS-Nxxxx-xxG, MS-Nxxxx-xxE, MS-Nxxxx-xxT, MS-Nxxxx-xxH and MS-Nxxxx-xxC), due to a weak password reset mechanism at the Milesight NVR web-based management interface. A remote attacker could exploit this vulnerability by sending a specially crafted http requests on the targeted device. Successful exploitation of this vulnerability could allow remote attacker to account takeover on the targeted device.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2023-30466

Credits & Attribution

The following person or organization is credited with identifying this vulnerability, as recorded in the NVD database:

  • This vulnerability is reported by Souvik Kandar and Arko Dhar from Redinent Innovations Engineering & Research Team, Karnataka, India.

References

More from Milesight

View All →
CVE-2025-4043
Milesight UG65-868M-EA Improper Access Control for Volatile Memory Containing Boot Code
Medium 6.1
CVE-2023-47166
A firmware update vulnerability exists in the luci2-io file-import functionality...
High 8.8
CVE-2023-32220
Milesight NCR/Camera Authentication Bypass
High 8.2
CVE-2023-30467
Improper Authorization Vulnerability in Milesight Network Video Recorder (NVR)
High 7.5
CVE-2023-25583
Two OS command injection vulnerabilities exist in the zebra vlan_name...
High 7.2

Affected Vendor

Affected Software

NVR MS-Nxxxx-xxG, NVR MS-Nxxxx-xxE, NVR MS-Nxxxx-xxT, NVR MS-Nxxxx-xxH , NVR MS-Nxxxx-xxC
Vulnerable Versions:
77.X, 75.X, 72.X, 71.X, 73.X

Timeline

Official Publish: April 28th, 2023
Last Modified: January 30th, 2025
Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weaknesses (CWE)

CWE-640

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.