// For flags

CVE-2014-8756

Panasonic Network Camera Recorder NcrCtl4.NcrNet.1 GetVOLHeader Arbitrary Write Remote Code Execution Vulnerability

Severity Score

6.8
*CVSS v2

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

0
*Multiple Sources

Exploited in Wild

-
*KEV

Decision

-
*SSVC
Descriptions

The NcrCtl4.NcrNet.1 control in Panasonic Network Camera Recorder before 4.04R03 allows remote attackers to execute arbitrary code via a crafted GetVOLHeader method call, which writes null bytes to an arbitrary address.

El control NcrCtl4.NcrNet.1 en Panasonic Network Camera Recorder anterior a 4.04R03 permite a atacantes remotos ejecutar código arbitrario a través de una llamada manipulada al método GetVOLHeader, escribiendo bytes nulos en una dirección arbitraria.

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Panasonic Network Camera Recorder. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.
The specific flaw exists within then NcrCtl4.NcrNet.1 control. The GetVOLHeader method can be used to write null bytes to an arbitrary address. An attacker can leverage this to execute arbitrary code in the context of the browser.

*Credits: Andrea Micalizzi (rgod)
CVSS Scores
Attack Vector
Network
Attack Complexity
Medium
Authentication
None
Confidentiality
Partial
Integrity
Partial
Availability
Partial
Attack Vector
Network
Attack Complexity
Low
Authentication
None
Confidentiality
Partial
Integrity
Partial
Availability
Partial
* Common Vulnerability Scoring System
SSVC
  • Decision:-
Exploitation
-
Automatable
-
Tech. Impact
-
* Organization's Worst-case Scenario
Timeline
  • 2014-10-13 CVE Reserved
  • 2014-10-14 CVE Published
  • 2024-08-06 CVE Updated
  • 2024-10-15 EPSS Updated
  • ---------- Exploited in Wild
  • ---------- KEV Due Date
  • ---------- First Exploit
CWE
CAPEC
Affected Vendors, Products, and Versions
Vendor Product Version Other Status
Vendor Product Version Other Status <-- --> Vendor Product Version Other Status
Panasonic
Search vendor "Panasonic"
 Network Camera Recorder Firmware
Search vendor "Panasonic" for product "Network Camera Recorder Firmware"
 < 4.04r03
Search vendor "Panasonic" for product "Network Camera Recorder Firmware" and version " < 4.04r03"
-
Affected
in Panasonic
Search vendor "Panasonic"
 Network Camera Recorder
Search vendor "Panasonic" for product "Network Camera Recorder"
--
Safe