Cleartext transmission of sensitive information in Longse Technology NVR3608PGE2W
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- Passive
- Attack complexity
- Low
- Attack requirements
- Present
- Impact type
- Information disclosure
- Confidentiality · integrity · availability
- High · None · None
- Fix status
- No fix listed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-319.
Summary
Longse NVR (Network Video Recorder) model NVR3608PGE2W, as well as products based on this device, are transmitting user's login and password to a remote control service without using any encryption. This enables an on-path attacker to eavesdrop the credentials and subsequently obtain access to the video stream. The credentials are being sent when a user decides to change his password in router's portal.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Longse Technology | NVR3608PGE2W | all versions | — | No fix listed | CNA |
| Zamel | ZMB-01 | all versions | — | No fix listed | CNA |
- NVR3608PGE2W VendorLongse Technology Affected all versions Fixed in — No fix listed CNA
- ZMB-01 VendorZamel Affected all versions Fixed in — No fix listed CNA
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2024-5631
- 2026-10-03 Alias added: GHSA-37h9-9838-7j9c
References
More Longse Technology vulnerabilities
- TI-2024-05231 Longse model LBH30FE200W cameras, as well as products based on this device, make use of… CVSS 4.0HIGH 8.6
- TI-2024-05230 Longse model LBH30FE200W cameras, as well as products based on this device, provide an… CVSS 4.0HIGH 7.5
- TI-2024-05229 Longse NVR (Network Video Recorder) model NVR3608PGE2W, as well as products based on this… CVSS 4.0MEDIUM 5.3
Sources
- CVE-2024-5631 · CVE Program
- CVE-2024-5631 · NVD
- FIRST EPSS
- GHSA-37h9-9838-7j9c · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences