TI-2023-03460 Aliases CVE-2023-3704 GHSA-8h45-26mw-gfqq

Timestamp Modification Vulnerability in CP-Plus Digital Video Recorder

LOW 31CWE-20Published 2023-08-24 · Updated 2024-10-04

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Impact type: —
Confidentiality · integrity · availability: None · Low · None
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA.

Summary

The vulnerability exists in CP-Plus DVR due to an improper input validation within the web-based management interface of the affected products. An unauthenticated remote attacker could exploit this vulnerability by sending specially crafted HTTP requests to the vulnerable device. Successful exploitation of this vulnerability could allow the remote attacker to change system time of the targeted device.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00686 52nd percentileScored 2026-11-07

Fix Fixed CP-UVR-1601E1-HC, CP-UVR-1601E2-H, CP-UVR-1601E1-H, CP-UVR-0801F1-HC, CP-UVR-0801K1-H, CP-UVR-0801K1B-H, CP-UVR-0808K1-H, CP-UVR-0401L1-4KH, CP-UVR-0401L1B-4KH (Aditya Infotech Limited ): 4.000.00AT008.0.R.20230302

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: Yes
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Aditya Infotech Limited	CP-UVR-1601E1-HC, CP-UVR-1601E2-H, CP-UVR-1601E1-H, CP-UVR-0801F1-HC, CP-UVR-0801K1-H, CP-UVR-0801K1B-H, CP-UVR-0808K1-H, CP-UVR-0401L1-4KH, CP-UVR-0401L1B-4KH	before 4.000.00AT008.0.R.20230302	4.000.00AT008.0.R.20230302	Patch available	CNA

CP-UVR-1601E1-HC, CP-UVR-1601E2-H, CP-UVR-1601E1-H, CP-UVR-0801F1-HC, CP-UVR-0801K1-H, CP-UVR-0801K1B-H, CP-UVR-0808K1-H, CP-UVR-0401L1-4KH, CP-UVR-0401L1B-4KH VendorAditya Infotech Limited Affected before 4.000.00AT008.0.R.20230302 Fixed in 4.000.00AT008.0.R.20230302 Patch available CNA

CPE configurations NVD · 18

CPE	Versions	Role	Vendor
cpe:2.3:o:cpplusworld:cp-uvr-1601e1-hc_firmware::::::::	before 4.000.00at008.0.0.r20230302	Vulnerable	Cpplusworld
cpe:2.3:h:cpplusworld:cp-uvr-1601e1-hc:-:::::::*	not specified by NVD	Running on	Cpplusworld
cpe:2.3:o:cpplusworld:cp-uvr-0401l1-4kh_firmware::::::::	before 4.000.00at008.0.0.r20230302	Vulnerable	Cpplusworld
cpe:2.3:h:cpplusworld:cp-uvr-0401l1-4kh:-:::::::*	not specified by NVD	Running on	Cpplusworld
cpe:2.3:o:cpplusworld:cp-uvr-0401l1b-4kh_firmware::::::::	before 4.000.00at008.0.0.r20230302	Vulnerable	Cpplusworld
cpe:2.3:h:cpplusworld:cp-uvr-0401l1b-4kh:-:::::::*	not specified by NVD	Running on	Cpplusworld
cpe:2.3:o:cpplusworld:cp-uvr-0801f1-hc_firmware::::::::	before 4.000.00at008.0.0.r20230302	Vulnerable	Cpplusworld
cpe:2.3:h:cpplusworld:cp-uvr-0801f1-hc:-:::::::*	not specified by NVD	Running on	Cpplusworld
cpe:2.3:o:cpplusworld:cp-uvr-0801k1-h_firmware::::::::	before 4.000.00at008.0.0.r20230302	Vulnerable	Cpplusworld
cpe:2.3:h:cpplusworld:cp-uvr-0801k1-h:-:::::::*	not specified by NVD	Running on	Cpplusworld

cpe:2.3:o:cpplusworld:cp-uvr-1601e1-hc_firmware:*:*:*:*:*:*:*:* Versions before 4.000.00at008.0.0.r20230302 Vulnerable ·Cpplusworld
cpe:2.3:h:cpplusworld:cp-uvr-1601e1-hc:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Cpplusworld
cpe:2.3:o:cpplusworld:cp-uvr-0401l1-4kh_firmware:*:*:*:*:*:*:*:* Versions before 4.000.00at008.0.0.r20230302 Vulnerable ·Cpplusworld
cpe:2.3:h:cpplusworld:cp-uvr-0401l1-4kh:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Cpplusworld
cpe:2.3:o:cpplusworld:cp-uvr-0401l1b-4kh_firmware:*:*:*:*:*:*:*:* Versions before 4.000.00at008.0.0.r20230302 Vulnerable ·Cpplusworld
cpe:2.3:h:cpplusworld:cp-uvr-0401l1b-4kh:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Cpplusworld
cpe:2.3:o:cpplusworld:cp-uvr-0801f1-hc_firmware:*:*:*:*:*:*:*:* Versions before 4.000.00at008.0.0.r20230302 Vulnerable ·Cpplusworld
cpe:2.3:h:cpplusworld:cp-uvr-0801f1-hc:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Cpplusworld
cpe:2.3:o:cpplusworld:cp-uvr-0801k1-h_firmware:*:*:*:*:*:*:*:* Versions before 4.000.00at008.0.0.r20230302 Vulnerable ·Cpplusworld
cpe:2.3:h:cpplusworld:cp-uvr-0801k1-h:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Cpplusworld

Show 8 more CPE

CPE	Versions	Role	Vendor
cpe:2.3:o:cpplusworld:cp-uvr-0801k1b-h_firmware::::::::	before 4.000.00at008.0.0.r20230302	Vulnerable	Cpplusworld
cpe:2.3:h:cpplusworld:cp-uvr-0801k1b-h:-:::::::*	not specified by NVD	Running on	Cpplusworld
cpe:2.3:o:cpplusworld:cp-uvr-0808k1-h_firmware::::::::	before 4.000.00at008.0.0.r20230302	Vulnerable	Cpplusworld
cpe:2.3:h:cpplusworld:cp-uvr-0808k1-h:-:::::::*	not specified by NVD	Running on	Cpplusworld
cpe:2.3:o:cpplusworld:cp-uvr-1601e1-h_firmware::::::::	before 4.000.00at008.0.0.r20230302	Vulnerable	Cpplusworld
cpe:2.3:h:cpplusworld:cp-uvr-1601e1-h:-:::::::*	not specified by NVD	Running on	Cpplusworld
cpe:2.3:o:cpplusworld:cp-uvr-1601e2-h_firmware::::::::	before 4.000.00at008.0.0.r20230302	Vulnerable	Cpplusworld
cpe:2.3:h:cpplusworld:cp-uvr-1601e2-h:-:::::::*	not specified by NVD	Running on	Cpplusworld

cpe:2.3:o:cpplusworld:cp-uvr-0801k1b-h_firmware:*:*:*:*:*:*:*:* Versions before 4.000.00at008.0.0.r20230302 Vulnerable ·Cpplusworld
cpe:2.3:h:cpplusworld:cp-uvr-0801k1b-h:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Cpplusworld
cpe:2.3:o:cpplusworld:cp-uvr-0808k1-h_firmware:*:*:*:*:*:*:*:* Versions before 4.000.00at008.0.0.r20230302 Vulnerable ·Cpplusworld
cpe:2.3:h:cpplusworld:cp-uvr-0808k1-h:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Cpplusworld
cpe:2.3:o:cpplusworld:cp-uvr-1601e1-h_firmware:*:*:*:*:*:*:*:* Versions before 4.000.00at008.0.0.r20230302 Vulnerable ·Cpplusworld
cpe:2.3:h:cpplusworld:cp-uvr-1601e1-h:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Cpplusworld
cpe:2.3:o:cpplusworld:cp-uvr-1601e2-h_firmware:*:*:*:*:*:*:*:* Versions before 4.000.00at008.0.0.r20230302 Vulnerable ·Cpplusworld
cpe:2.3:h:cpplusworld:cp-uvr-1601e2-h:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Cpplusworld

Remediation

Fix · CNA CP-UVR-1601E1-HC, CP-UVR-1601E2-H, CP-UVR-1601E1-H, CP-UVR-0801F1-HC, CP-UVR-0801K1-H, CP-UVR-0801K1B-H, CP-UVR-0808K1-H, CP-UVR-0401L1-4KH, CP-UVR-0401L1B-4KH (Aditya Infotech Limited ) Fixed in 4.000.00AT008.0.R.20230302

Timeline

2026-10-02 Threatist record created from CVE-2023-3704
2026-10-03 Alias added: GHSA-8h45-26mw-gfqq

References

Advisory 1

https://www.cert-in.org.in/s2cMainServlet?pageid=PUBVLNOTES01&VLCODE=CIVN-2023-0240

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences