What’s Vulnerable › Vulnerabilities

CVE-2018-11689

• Severity: medium (CVSS 6.1 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.6% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2018-06-14 · updated 2026-06-17
• Weakness: CWE-79

Description

Web Viewer for Hanwha DVR 2.17 and Smart Viewer in Samsung Web Viewer for Samsung DVR are vulnerable to XSS via the /cgi-bin/webviewer_login_page data3 parameter. (The same Web Viewer codebase was transitioned from Samsung to Hanwha.)

Affected products

• Hanwha-Security Hrd-1641 Firmware: through 1.14
• Hanwha-Security Hrd-1642 Firmware: through 1.16
• Hanwha-Security Hrd-440 Firmware: through 1.14
• Hanwha-Security Hrd-442 Firmware: through 1.16
• Hanwha-Security Hrd-443 Firmware: through 1.14
• Hanwha-Security Hrd-840 Firmware: through 1.14
• Hanwha-Security Hrd-841 Firmware: through 1.14
• Hanwha-Security Hrd-842 Firmware: through 1.16
• Hanwha-Security Srd-1694U Firmware: through 1.14
• Samsung Smartviewer: all versions

References

• http://www.securityfocus.com/archive/1/542083/100/0/threaded
• https://drive.google.com/file/d/1aWbvdrx1KRkUv4ikkm530a2N5qrxCLmr/view?usp=sharing
• https://seclists.org/bugtraq/2018/Jun/40
• https://vulmon.com/vulnerabilitydetails?qid=CVE-2018-11689
• http://www.securityfocus.com/archive/1/542083/100/0/threaded
• https://drive.google.com/file/d/1aWbvdrx1KRkUv4ikkm530a2N5qrxCLmr/view?usp=sharing
• https://seclists.org/bugtraq/2018/Jun/40
• https://vulmon.com/vulnerabilitydetails?qid=CVE-2018-11689

Get alerted when CVE-2018-11689 or the next vulnerability affects your stack