SID 1:42857

Report a false positive

Rule Category

SERVER-WEBAPP -- Snort has detected traffic exploiting vulnerabilities in web based applications on servers.

Alert Message

SERVER-WEBAPP MVPower DVR Shell arbitrary command execution attempt

Rule Explanation

The rule alerts in the event there is an arbitrary command injection execution detected in MVPower DVR Shell. There is potential for multiple failures in confidentiality, integrity and availability due to arbitrary remote code execution.

What To Look For

This event is generated when an attempt is made to exploit a remote command injection vulnerability in MVPower DVR devices.

Known Usage

Public information/Proof of Concept available

False Positives

No known false positives

Contributors

Cisco Talos Intelligence Group

Rule Groups

No rule groups

CVE

None

Additional Links

www.pentestpartners.com/blog/pwning-cctv-cameras/

Rule Vulnerability

No information provided

CVE Additional Information

This product uses data from the NVD API but is not endorsed or certified by the NVD.

None

MITRE ATT&CK Framework

Tactic: Execution

Technique: Malicious File

For reference, see the MITRE ATT&CK vulnerability types here: https://attack.mitre.org