{"id":"CVE-2022-45045","aliases":["EUVD-2022-47970","GHSA-rx5h-hxv6-mwc2"],"status":"published","title":"Multiple Xiongmai NVR devices, including MBD6304T V4.02.R11.00000117.10001.131900.00000 and...","description":"Multiple Xiongmai NVR devices, including MBD6304T V4.02.R11.00000117.10001.131900.00000 and NBD6808T-PL V4.02.R11.C7431119.12001.130000.00000, allow authenticated users to execute arbitrary commands as root, as exploited in the wild starting in approximately 2019. A remote and authenticated attacker, possibly using the default admin:tlJwpbo6 credentials, can connect to port 34567 and execute arbitrary operating system commands via a crafted JSON file during an upgrade request. Since at least 2021, Xiongmai has applied patches to prevent attackers from using this mechanism to execute telnetd.","severity":{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.02431,"percentile":0.8436,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-78"],"published":"2022-12-01T00:00:00Z","modified":"2026-06-17T05:09:14Z","products":[{"vendor":"xiongmaitech","product":"mbd6304t"},{"vendor":"xiongmaitech","product":"mbd6304t_firmware"},{"vendor":"xiongmaitech","product":"nbd6808t-pl"},{"vendor":"xiongmaitech","product":"nbd6808t-pl_firmware"},{"vendor":"xiongmaitech","product":"nbd7004t-p"},{"vendor":"xiongmaitech","product":"nbd7004t-p_firmware"},{"vendor":"xiongmaitech","product":"nbd7008t-p"},{"vendor":"xiongmaitech","product":"nbd7008t-p_firmware"},{"vendor":"xiongmaitech","product":"nbd7016t-f-v2"},{"vendor":"xiongmaitech","product":"nbd7016t-f-v2_firmware"},{"vendor":"xiongmaitech","product":"nbd7024h-p"},{"vendor":"xiongmaitech","product":"nbd7024h-p_firmware"},{"vendor":"xiongmaitech","product":"nbd7024t-p"},{"vendor":"xiongmaitech","product":"nbd7024t-p_firmware"},{"vendor":"xiongmaitech","product":"nbd7804r-f\\(ep\\)"},{"vendor":"xiongmaitech","product":"nbd7804r-f\\(ep\\)_firmware"},{"vendor":"xiongmaitech","product":"nbd7804r-f\\(hdmi\\)"},{"vendor":"xiongmaitech","product":"nbd7804r-f\\(hdmi\\)_firmware"},{"vendor":"xiongmaitech","product":"nbd7804r-fw"},{"vendor":"xiongmaitech","product":"nbd7804r-fw_firmware"},{"vendor":"xiongmaitech","product":"nbd7804t-pl"},{"vendor":"xiongmaitech","product":"nbd7804t-pl_firmware"},{"vendor":"xiongmaitech","product":"nbd7808r-pl\\(ep\\)"},{"vendor":"xiongmaitech","product":"nbd7808r-pl\\(ep\\)_firmware"},{"vendor":"xiongmaitech","product":"nbd7808r-pl\\(hdmi\\)"},{"vendor":"xiongmaitech","product":"nbd7808r-pl\\(hdmi\\)_firmware"},{"vendor":"xiongmaitech","product":"nbd7808t-pl"},{"vendor":"xiongmaitech","product":"nbd7808t-pl_firmware"},{"vendor":"xiongmaitech","product":"nbd7904r-fs"},{"vendor":"xiongmaitech","product":"nbd7904r-fs_firmware"},{"vendor":"xiongmaitech","product":"nbd7904t-p"},{"vendor":"xiongmaitech","product":"nbd7904t-p_firmware"},{"vendor":"xiongmaitech","product":"nbd7904t-pl"},{"vendor":"xiongmaitech","product":"nbd7904t-pl-xpoe"},{"vendor":"xiongmaitech","product":"nbd7904t-pl-xpoe_firmware"},{"vendor":"xiongmaitech","product":"nbd7904t-pl_firmware"},{"vendor":"xiongmaitech","product":"nbd7904t-plc-xpoe"},{"vendor":"xiongmaitech","product":"nbd7904t-plc-xpoe_firmware"},{"vendor":"xiongmaitech","product":"nbd7904t-q"},{"vendor":"xiongmaitech","product":"nbd7904t-q_firmware"},{"vendor":"xiongmaitech","product":"nbd7908t-q"},{"vendor":"xiongmaitech","product":"nbd7908t-q_firmware"},{"vendor":"xiongmaitech","product":"nbd8004r-pl\\(ep\\)"},{"vendor":"xiongmaitech","product":"nbd8004r-pl\\(ep\\)_firmware"},{"vendor":"xiongmaitech","product":"nbd8004r-yl\\(ep\\)"},{"vendor":"xiongmaitech","product":"nbd8004r-yl\\(ep\\)_firmware"},{"vendor":"xiongmaitech","product":"nbd8004t-q"},{"vendor":"xiongmaitech","product":"nbd8004t-q_firmware"},{"vendor":"xiongmaitech","product":"nbd8008r-pl"},{"vendor":"xiongmaitech","product":"nbd8008r-pl\\(ep\\)"},{"vendor":"xiongmaitech","product":"nbd8008r-pl\\(ep\\)_firmware"},{"vendor":"xiongmaitech","product":"nbd8008r-pl_firmware"},{"vendor":"xiongmaitech","product":"nbd8008r-yl\\(ep\\)"},{"vendor":"xiongmaitech","product":"nbd8008r-yl\\(ep\\)_firmware"},{"vendor":"xiongmaitech","product":"nbd8008ra-gl"},{"vendor":"xiongmaitech","product":"nbd8008ra-gl_firmware"},{"vendor":"xiongmaitech","product":"nbd8008ra-glk"},{"vendor":"xiongmaitech","product":"nbd8008ra-glk_firmware"},{"vendor":"xiongmaitech","product":"nbd8008ra-ul\\(ep\\)"},{"vendor":"xiongmaitech","product":"nbd8008ra-ul\\(ep\\)_firmware"},{"vendor":"xiongmaitech","product":"nbd8008ra-ula"},{"vendor":"xiongmaitech","product":"nbd8008ra-ula_firmware"},{"vendor":"xiongmaitech","product":"nbd8008ra-ulk"},{"vendor":"xiongmaitech","product":"nbd8008ra-ulk_firmware"},{"vendor":"xiongmaitech","product":"nbd8008t-q"},{"vendor":"xiongmaitech","product":"nbd8008t-q_firmware"},{"vendor":"xiongmaitech","product":"nbd8009s-ula-v2"},{"vendor":"xiongmaitech","product":"nbd8009s-ula-v2_firmware"},{"vendor":"xiongmaitech","product":"nbd8010s-kl-v2"},{"vendor":"xiongmaitech","product":"nbd8010s-kl-v2_firmware"},{"vendor":"xiongmaitech","product":"nbd8016r-ul"},{"vendor":"xiongmaitech","product":"nbd8016r-ul_firmware"},{"vendor":"xiongmaitech","product":"nbd8016ra-k\\(ep\\)"},{"vendor":"xiongmaitech","product":"nbd8016ra-k\\(ep\\)_firmware"},{"vendor":"xiongmaitech","product":"nbd8016ra-ul"},{"vendor":"xiongmaitech","product":"nbd8016ra-ul\\(ep\\)"},{"vendor":"xiongmaitech","product":"nbd8016ra-ul\\(ep\\)_firmware"},{"vendor":"xiongmaitech","product":"nbd8016ra-ul_firmware"},{"vendor":"xiongmaitech","product":"nbd8016ra-ula"},{"vendor":"xiongmaitech","product":"nbd8016ra-ula_firmware"},{"vendor":"xiongmaitech","product":"nbd8016ra-ulk"},{"vendor":"xiongmaitech","product":"nbd8016ra-ulk_firmware"},{"vendor":"xiongmaitech","product":"nbd8016s-kl-v2"},{"vendor":"xiongmaitech","product":"nbd8016s-kl-v2_firmware"},{"vendor":"xiongmaitech","product":"nbd8016s-ula-v2"},{"vendor":"xiongmaitech","product":"nbd8016s-ula-v2_firmware"},{"vendor":"xiongmaitech","product":"nbd8016t-q-v2"},{"vendor":"xiongmaitech","product":"nbd8016t-q-v2_firmware"},{"vendor":"xiongmaitech","product":"nbd8025r-ul"},{"vendor":"xiongmaitech","product":"nbd8025r-ul_firmware"},{"vendor":"xiongmaitech","product":"nbd8032h4-p"},{"vendor":"xiongmaitech","product":"nbd8032h4-p_firmware"},{"vendor":"xiongmaitech","product":"nbd8032h4-q"},{"vendor":"xiongmaitech","product":"nbd8032h4-q_firmware"},{"vendor":"xiongmaitech","product":"nbd8032h4-qe"},{"vendor":"xiongmaitech","product":"nbd8032h4-qe_firmware"},{"vendor":"xiongmaitech","product":"nbd8032h4-ul"},{"vendor":"xiongmaitech","product":"nbd8032h4-ul_firmware"},{"vendor":"xiongmaitech","product":"nbd8032h8-p"},{"vendor":"xiongmaitech","product":"nbd8032h8-p_firmware"},{"vendor":"xiongmaitech","product":"nbd8032h8-qe"},{"vendor":"xiongmaitech","product":"nbd8032h8-qe_firmware"},{"vendor":"xiongmaitech","product":"nbd8032ra-ul-v2"},{"vendor":"xiongmaitech","product":"nbd8032ra-ul-v2_firmware"},{"vendor":"xiongmaitech","product":"nbd8064h8-p"},{"vendor":"xiongmaitech","product":"nbd8064h8-p_firmware"},{"vendor":"xiongmaitech","product":"nbd80n16ra-kl"},{"vendor":"xiongmaitech","product":"nbd80n16ra-kl\\(ep\\)"},{"vendor":"xiongmaitech","product":"nbd80n16ra-kl\\(ep\\)_firmware"},{"vendor":"xiongmaitech","product":"nbd80n16ra-kl_firmware"},{"vendor":"xiongmaitech","product":"nbd80s08s-kl\\(ep\\)"},{"vendor":"xiongmaitech","product":"nbd80s08s-kl\\(ep\\)_firmware"},{"vendor":"xiongmaitech","product":"nbd80s10s-kl"},{"vendor":"xiongmaitech","product":"nbd80s10s-kl_firmware"},{"vendor":"xiongmaitech","product":"nbd80s16s-kl"},{"vendor":"xiongmaitech","product":"nbd80s16s-kl\\(ep\\)"},{"vendor":"xiongmaitech","product":"nbd80s16s-kl\\(ep\\)_firmware"},{"vendor":"xiongmaitech","product":"nbd80s16s-kl_firmware"},{"vendor":"xiongmaitech","product":"nbd80x09ra-kl"},{"vendor":"xiongmaitech","product":"nbd80x09ra-kl_firmware"},{"vendor":"xiongmaitech","product":"nbd80x09s-kl"},{"vendor":"xiongmaitech","product":"nbd80x09s-kl_firmware"},{"vendor":"xiongmaitech","product":"nbd88x09s-kl"},{"vendor":"xiongmaitech","product":"nbd88x09s-kl_firmware"},{"vendor":"xiongmaitech","product":"nbd8904r-pl"},{"vendor":"xiongmaitech","product":"nbd8904r-pl_firmware"},{"vendor":"xiongmaitech","product":"nbd8904r-yl"},{"vendor":"xiongmaitech","product":"nbd8904r-yl_firmware"},{"vendor":"xiongmaitech","product":"nbd8904t-gsc-xpoe"},{"vendor":"xiongmaitech","product":"nbd8904t-gsc-xpoe_firmware"},{"vendor":"xiongmaitech","product":"nbd8904t-q"},{"vendor":"xiongmaitech","product":"nbd8904t-q_firmware"},{"vendor":"xiongmaitech","product":"nbd8908r-pl"},{"vendor":"xiongmaitech","product":"nbd8908r-pl_firmware"},{"vendor":"xiongmaitech","product":"nbd8908r-yl"},{"vendor":"xiongmaitech","product":"nbd8908r-yl_firmware"},{"vendor":"xiongmaitech","product":"nbd8908t-pl-xpoe"},{"vendor":"xiongmaitech","product":"nbd8908t-pl-xpoe_firmware"},{"vendor":"xiongmaitech","product":"nbd8908t-plc-xpoe"},{"vendor":"xiongmaitech","product":"nbd8908t-plc-xpoe_firmware"},{"vendor":"xiongmaitech","product":"nbd8916f4-q"},{"vendor":"xiongmaitech","product":"nbd8916f4-q_firmware"},{"vendor":"xiongmaitech","product":"nbd8916f8-q"},{"vendor":"xiongmaitech","product":"nbd8916f8-q_firmware"}],"references":[{"url":"https://vulncheck.com/blog/xiongmai-iot-exploitation","tags":["x_transferred","Exploit","Technical Description","Third Party Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-45045"},{"url":"https://github.com/advisories/GHSA-rx5h-hxv6-mwc2"}],"sources":{"cve":[{"id":"CVE-2022-45045","description":"Multiple Xiongmai NVR devices, including MBD6304T V4.02.R11.00000117.10001.131900.00000 and NBD6808T-PL V4.02.R11.C7431119.12001.130000.00000, allow authenticated users to execute arbitrary commands as root, as exploited in the wild starting in approximately 2019. A remote and authenticated attacker, possibly using the default admin:tlJwpbo6 credentials, can connect to port 34567 and execute arbitrary operating system commands via a crafted JSON file during an upgrade request. Since at least 2021, Xiongmai has applied patches to prevent attackers from using this mechanism to execute telnetd.","status":"published","published":"2022-12-01T00:00:00Z","modified":"2025-04-24T20:09:06.565Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"adp"}],"cwes":["CWE-78"],"updated_at":"2026-11-02T14:34:31.184134Z"}],"euvd":[{"id":"EUVD-2022-47970","description":"Multiple Xiongmai NVR devices, including MBD6304T V4.02.R11.00000117.10001.131900.00000 and NBD6808T-PL V4.02.R11.C7431119.12001.130000.00000, allow authenticated users to execute arbitrary commands as root, as exploited in the wild starting in approximately 2019. A remote and authenticated attacker, possibly using the default admin:tlJwpbo6 credentials, can connect to port 34567 and execute arbitrary operating system commands via a crafted JSON file during an upgrade request. Since at least 2021, Xiongmai has applied patches to prevent attackers from using this mechanism to execute telnetd.","status":"published","published":"2022-12-01T00:00:00Z","modified":"2025-04-24T20:09:06Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T20:52:03.523577Z"}],"ghsa":[{"id":"GHSA-rx5h-hxv6-mwc2","title":"Multiple Xiongmai NVR devices, including MBD6304T V4.02.R11.00000117.10001.131900.00000 and...","description":"Multiple Xiongmai NVR devices, including MBD6304T V4.02.R11.00000117.10001.131900.00000 and NBD6808T-PL V4.02.R11.C7431119.12001.130000.00000, allow authenticated users to execute arbitrary commands as root, as exploited in the wild starting in approximately 2019. A remote and authenticated attacker, possibly using the default admin:tlJwpbo6 credentials, can connect to port 34567 and execute arbitrary operating system commands via a crafted JSON file during an upgrade request. Since at least 2021, Xiongmai has applied patches to prevent attackers from using this mechanism to execute telnetd.","status":"published","published":"2022-12-01T06:30:25Z","modified":"2023-01-31T05:03:00Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-78"],"updated_at":"2026-11-02T14:48:23.185743Z"}],"nvd":[{"id":"CVE-2022-45045","description":"Multiple Xiongmai NVR devices, including MBD6304T V4.02.R11.00000117.10001.131900.00000 and NBD6808T-PL V4.02.R11.C7431119.12001.130000.00000, allow authenticated users to execute arbitrary commands as root, as exploited in the wild starting in approximately 2019. A remote and authenticated attacker, possibly using the default admin:tlJwpbo6 credentials, can connect to port 34567 and execute arbitrary operating system commands via a crafted JSON file during an upgrade request. Since at least 2021, Xiongmai has applied patches to prevent attackers from using this mechanism to execute telnetd.","status":"published","published":"2022-12-01T05:15:12.043Z","modified":"2026-06-17T05:09:14.64Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"},{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-78"],"updated_at":"2026-11-02T14:07:32.827264Z"}]}}