What’s Vulnerable › Vulnerabilities

CVE-2022-26259

• Severity: high (CVSS 7.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 2.4% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2022-03-28 · updated 2026-06-17
• Weakness: CWE-120

Description

A buffer over flow in Xiongmai DVR devices NBD80X16S-KL, NBD80X09S-KL, NBD80X08S-KL, NBD80X09RA-KL, AHB80X04R-MH, AHB80X04R-MH-V2, AHB80X04-R-MH-V3, AHB80N16T-GS, AHB80N32F4-LME, and NBD90S0VT-QW allows attackers to cause a Denial of Service (DoS) via a crafted RSTP request.

Affected products

• Xiongmaitech Ahb80N16T-Gs Firmware: 4.03.r11.7601.nat.onvifc.20211223
• Xiongmaitech Ahb80N32F4-Lme Firmware: 4.03.r11.7601.nat.onvifc.20211228
• Xiongmaitech Ahb80X04-R-Mh-V3 Firmware: 4.03.r11.nat.dss.onvifc.20210729
• Xiongmaitech Ahb80X04R-Mh-V2 Firmware: 4.03.r11.nat.dss.onvifc.20210729
• Xiongmaitech Ahb80X04R-Mh Firmware: 4.03.r11.nat.dss.onvifc.20210729
• Xiongmaitech Nbd80X08S-Kl Firmware: 4.03.r11.nat.dss.onvifc.20210727
• Xiongmaitech Nbd80X09Ra-Kl Firmware: 4.03.r11.nat.dss.onvifc.20210727
• Xiongmaitech Nbd80X09S-Kl Firmware: 4.03.r11.nat.dss.onvifc.20210727
• Xiongmaitech Nbd80X16S-Kl Firmware: 4.03.r11.nat.dss.onvifc.20210727
• Xiongmaitech Nbd90S0Vt-Qw Firmware: 4.03.r11.713g.nat.onvifc.2021

References

• https://blog.ret2.me/post/2022-01-26-exploiting-xiongmai-dvrs/
• https://www.xiongmaitech.com/en/index.php/service/notice_info/51/2
• https://blog.ret2.me/post/2022-01-26-exploiting-xiongmai-dvrs/
• https://www.xiongmaitech.com/en/index.php/service/notice_info/51/2

Get alerted when CVE-2022-26259 or the next vulnerability affects your stack