Buffer overflow in Hisilicon Hi3516
CVE-2019-11560
A buffer overflow vulnerability in the streaming server provided by hisilicon in HI3516 models allows an unauthenticated attacker to remotely run arbitrary code by sending a special RTSP over HTTP packet. The vulnerability was found in many cameras using hisilicon's hardware and software, as demonstrated by TENVIS cameras 1.3.3.3, 1.2.7.2, 1.2.1.4, 7.1.20.1.2, and 13.1.1.1.7.2; FDT FD7902 11.3.14.1.3 and 10.3.14.1.3; FOSCAM cameras 3.2.1.1.1_0815 and 3.2.2.2.1_0815; and Dericam cameras V11.3.8.1.12.
Vulnerability class: Buffer Overflow
EPSS: 0.019 (77.9th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 9.8 (Critical). Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.
Affected products
- Hisilicon Hi3516
- Hisilicon Hi3516_firmware
- N/a — versions n/a
Weakness classification (CWE)
References
- cve@mitre.org (Third Party Advisory, x_refsource_MISC)
Frequently asked questions
- What is CVE-2019-11560?
- CVE-2019-11560 is a critical-severity vulnerability in Hisilicon Hi3516, classified under Out-of-bounds Write. CVSS score: 9.8/10. Published 2019-05-07.
- How severe is CVE-2019-11560?
- Critical severity. CVSS v3 base score is 9.8 out of 10.