medium5.0Public exploit code
CVE-2007-4583
Multiple absolute path traversal vulnerabilities in the nvUtility.Utility.1 ActiveX control in nvUtility.dll 1.0.14.0 in ACTi Network Video Recorder (NVR) SP2 …
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- NVR SP2 2.0 'nvUtility.dll 1.0.14.0' - 'DeleteXMLFile()' Insecure Method2007-08-27 · remote · windows · Verified
- NVR SP2 2.0 'nvUtility.dll 1.0.14.0' - 'SaveXMLFile()' Insecure Method2007-08-27 · remote · windows · Verified
Impact
Multiple absolute path traversal vulnerabilities in the nvUtility.Utility.1 ActiveX control in nvUtility.dll 1.0.14.0 in ACTi Network Video Recorder (NVR) SP2 2.0 allow remote attackers to (1) create or overwrite arbitrary files via a full pathname in the first argument to the SaveXMLFile method or (2) delete arbitrary files via a full pathname in the argument to the DeleteXMLFile method.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Acti | Network Video Recorder | Version sp2_2.0 |
Weakness classification
References
- NVD record
- CVE.org record
- http://osvdb.org/38386
- http://osvdb.org/38387
- http://secunia.com/advisories/26622
- http://www.securityfocus.com/bid/25465
- http://www.vupen.com/english/advisories/2007/2993
- https://exchange.xforce.ibmcloud.com/vulnerabilities/36303
- https://exchange.xforce.ibmcloud.com/vulnerabilities/36304
- https://www.exploit-db.com/exploits/4323
- https://www.exploit-db.com/exploits/4324
- http://osvdb.org/38386
- http://osvdb.org/38387
- http://secunia.com/advisories/26622
- http://www.securityfocus.com/bid/25465
- http://www.vupen.com/english/advisories/2007/2993
- https://exchange.xforce.ibmcloud.com/vulnerabilities/36303
- https://exchange.xforce.ibmcloud.com/vulnerabilities/36304
- https://www.exploit-db.com/exploits/4323
- https://www.exploit-db.com/exploits/4324