Every CVESearch/Get API key

CVE-2017-14335

On Beijing Hanbang Hanbanggaoke devices, because user-controlled input is not sufficiently...

7.5 HighPublic exploit

CVE-2017-14335 is a high vulnerability (CVSS 7.5) in Hbgk 7204xr Firmware, published September 12, 2017. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 27.8%, the 98th percentile. No source names a fixed version.

What does this mean?
Severity
7.5 HighCVSS 3.0, NVD
Exploit chance
27.8%EPSS, 98th percentile
Exploitation
None known1 public exploit
Fixed in
No fix listedNo source names one

Description

On Beijing Hanbang Hanbanggaoke devices, because user-controlled input is not sufficiently sanitized, sending a PUT request to /ISAPI/Security/users/1 allows an admin password change.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
None
Integrity
High
Availability
None

Exploit likelihood

27.8%Up 26.0 points since Apr 14, 2021
90%50%10%1%

Affected products

Show 57 moreShow less

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
SourceLinkDate
Exploit-DBHanbanggaoke IP Camera - Arbitrary Password Change2017-09-11

What each source reports

NVD Score used7.5

On Beijing Hanbang Hanbanggaoke devices, because user-controlled input is not sufficiently sanitized, sending a PUT request to /ISAPI/Security/users/1 allows an admin password change.

Record
CVE-2017-14335
CVSS 3.0
7.5 HighCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
CVSS 2.0
5.0 MediumAV:N/AC:L/Au:N/C:N/I:P/A:N
Weakness
CWE-20
Updated
2026-11-02
CVE ListNo score

On Beijing Hanbang Hanbanggaoke devices, because user-controlled input is not sufficiently sanitized, sending a PUT request to /ISAPI/Security/users/1 allows an admin password change.

Record
CVE-2017-14335
Updated
2026-11-02
EUVDEUVD-2017-5838No score

On Beijing Hanbang Hanbanggaoke devices, because user-controlled input is not sufficiently sanitized, sending a PUT request to /ISAPI/Security/users/1 allows an admin password change.

Record
EUVD-2017-5838
Updated
2026-11-03
GitHub AdvisoriesGHSA-68qc-fv6j-x2677.5

On Beijing Hanbang Hanbanggaoke devices, because user-controlled input is not sufficiently...

On Beijing Hanbang Hanbanggaoke devices, because user-controlled input is not sufficiently sanitized, sending a PUT request to /ISAPI/Security/users/1 allows an admin password change.

Record
GHSA-68qc-fv6j-x267
CVSS 3.0
7.5 HighCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Weakness
CWE-20
Updated
2026-11-02

History

History
RecordedChangedSources
facts
aliasesEUVD
first indexedCVE List, Exploit-DB, GitHub Advisories, NVD

Dates are when Every CVE recorded each change. Upstream dates may differ.

References

PagesAll vulnerabilitiesBrowseDocsSourcesGuideGet API key
MoveEnter Open