CVE-2019-12223
Hanwha Vision
- Published
- 5 September 2019
- Last modified
- 17 June 2026
- CVSS
- 7.5 v3.0
- Severity
- high
- EPSS
- 2.4% (83th pct)
- CISA KEV
- Not listed
- NVD status
- Modified
- Weaknesses
- CWE-119
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Description
An issue was discovered in NVR WebViewer on Hanwah Techwin SRN-472s 1.07_190502 devices, and other SRN-x devices before 2019-05-03. A system crash and reboot can be achieved by submitting a long username in excess of 117 characters. The username triggers a buffer overflow in the main process controlling operation of the DVR system, rendering services unavailable during the reboot operation. A repeated attack affects availability as long as the attacker has network access to the device.
Exploitation
Not listed in the CISA Known Exploited Vulnerabilities catalogue as of 2026.09.04. That is an absence of confirmed public exploitation, not evidence that exploitation has not occurred. EPSS models a 2.4% probability of exploitation activity in the next 30 days.
Affected products
| Product | Vendor | Type | Versions named |
|---|---|---|---|
| SRN-1673S | Hanwha Vision | unknown | < 2019-05-03 |
| SRN-472S | Hanwha Vision | unknown | 1.07_190502 |
| SRN-873S | Hanwha Vision | unknown | < 2019-05-03 |
References
- https://gist.github.com/dustinnoe/66f91573a0080c9fb2c21819d8805a82 exploit
- https://medium.com/%40noe.dustin/samsung-webviewer-remote-dos-vulberability-cve-2019-12223-5f4afbc83fbd
- https://www.hanwha-security.com/en/products/video-recorder/nvr/ch4/SRN-472S/overview/
- https://gist.github.com/dustinnoe/66f91573a0080c9fb2c21819d8805a82 exploit
- https://medium.com/%40noe.dustin/samsung-webviewer-remote-dos-vulberability-cve-2019-12223-5f4afbc83fbd
- https://www.hanwha-security.com/en/products/video-recorder/nvr/ch4/SRN-472S/overview/
Record assembled from NVD, CISA KEV 2026.09.04 and FIRST EPSS 2026-09-04. Affected products are those NVD's CPE configuration names that fall inside this site's scope; a CVE may affect products outside it.