{"id":"CVE-2022-3001","aliases":["EUVD-2022-42440","GHSA-66hg-757x-5pgv"],"status":"published","title":"Vulnerability in Milesight Video Management Systems (VMS)","description":"This vulnerability exists in Milesight Video Management Systems (VMS), all firmware versions prior to 40.7.0.79-r1, due to improper input handling at camera’s web-based management interface. A remote attacker could exploit this vulnerability by sending a specially crafted http request on the targeted network camera. Successful exploitation of this vulnerability could allow the attacker to cause a Denial of Service condition on the targeted device.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.01404,"percentile":0.72789,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-20"],"published":"2022-09-15T14:38:17Z","modified":"2026-06-17T04:58:37Z","products":[{"vendor":"milesight","product":"video management systems"},{"vendor":"milesight","product":"video_management_systems_firmware"}],"references":[{"url":"https://www.cert-in.org.in/s2cMainServlet?pageid=PUBVLNOTES01\u0026VLCODE=CIVN-2022-0352","tags":["x_refsource_MISC","x_transferred","Third Party Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-3001"},{"url":"https://github.com/advisories/GHSA-66hg-757x-5pgv"}],"sources":{"cve":[{"id":"CVE-2022-3001","title":"Vulnerability in Milesight Video Management Systems (VMS)","description":"This vulnerability exists in Milesight Video Management Systems (VMS), all firmware versions prior to 40.7.0.79-r1, due to improper input handling at camera’s web-based management interface. A remote attacker could exploit this vulnerability by sending a specially crafted http request on the targeted network camera. Successful exploitation of this vulnerability could allow the attacker to cause a Denial of Service condition on the targeted device.","status":"published","published":"2022-09-15T14:38:17.41Z","modified":"2024-09-16T17:47:40.718Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"cna"}],"cwes":["CWE-20"],"updated_at":"2026-11-02T14:34:33.24035Z"}],"euvd":[{"id":"EUVD-2022-42440","description":"This vulnerability exists in Milesight Video Management Systems (VMS), all firmware versions prior to 40.7.0.79-r1, due to improper input handling at camera’s web-based management interface. A remote attacker could exploit this vulnerability by sending a specially crafted http request on the targeted network camera. Successful exploitation of this vulnerability could allow the attacker to cause a Denial of Service condition on the targeted device.","status":"published","published":"2022-09-15T14:38:17Z","modified":"2024-09-16T17:47:40Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-03T00:55:39.247967Z"}],"ghsa":[{"id":"GHSA-66hg-757x-5pgv","title":"This vulnerability exists in Milesight Video Management Systems (VMS), all firmware versions...","description":"This vulnerability exists in Milesight Video Management Systems (VMS), all firmware versions prior to 40.7.0.79-r1, due to improper input handling at camera’s web-based management interface. A remote attacker could exploit this vulnerability by sending a specially crafted http request on the targeted network camera. Successful exploitation of this vulnerability could allow the attacker to cause a Denial of Service condition on the targeted device.","status":"published","published":"2022-09-16T00:00:38Z","modified":"2023-01-28T05:03:02Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-20"],"updated_at":"2026-11-02T14:43:53.587553Z"}],"nvd":[{"id":"CVE-2022-3001","description":"This vulnerability exists in Milesight Video Management Systems (VMS), all firmware versions prior to 40.7.0.79-r1, due to improper input handling at camera’s web-based management interface. A remote attacker could exploit this vulnerability by sending a specially crafted http request on the targeted network camera. Successful exploitation of this vulnerability could allow the attacker to cause a Denial of Service condition on the targeted device.","status":"published","published":"2022-09-15T15:15:10.4Z","modified":"2026-06-17T04:58:37.567Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"secondary"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary"}],"cwes":["CWE-20"],"updated_at":"2026-11-02T14:07:28.118799Z"}]}}