CVE-2019-12223

An issue was discovered in NVR WebViewer on Hanwah Techwin SRN-472s 1.07_190502 devices, and other SRN-x devices before 2019-05-03. A system crash and reboot can be achieved by submitting a long username in excess of 117 characters. The username triggers a buffer overflow in the main process controlling operation of the DVR system, rendering services unavailable during the reboot operation. A repeated attack affects availability as long as the attacker has network access to the device.

• CWE-119

• https://gist.github.com/dustinnoe/66f91573a0080c9fb2c21819d8805a82Exploit, Third Party Advisory
• https://medium.com/%40noe.dustin/samsung-webviewer-remote-dos-vulberability-cve-2019-12223-5f4afbc83fbd
• https://www.hanwha-security.com/en/products/video-recorder/nvr/ch4/SRN-472S/overview/Product
• https://gist.github.com/dustinnoe/66f91573a0080c9fb2c21819d8805a82Exploit, Third Party Advisory
• https://medium.com/%40noe.dustin/samsung-webviewer-remote-dos-vulberability-cve-2019-12223-5f4afbc83fbd
• https://www.hanwha-security.com/en/products/video-recorder/nvr/ch4/SRN-472S/overview/Product

Published

Sep 5, 2019

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2019-12218An issue was discovered in libSDL2.a in Simple DirectMedia L…
• CVE-2019-12219An issue was discovered in libSDL2.a in Simple DirectMedia L…
• CVE-2019-1222A remote code execution vulnerability exists in Remote Deskt…9.8
• CVE-2019-12220An issue was discovered in libSDL2.a in Simple DirectMedia L…
• CVE-2019-12221An issue was discovered in libSDL2.a in Simple DirectMedia L…6.5
• CVE-2019-12222An issue was discovered in libSDL2.a in Simple DirectMedia L…
• CVE-2019-1223A denial of service vulnerability exists in Remote Desktop P…7.5
• CVE-2019-12239The WP Booking System plugin 1.5.1 for WordPress has no CSRF…7.2
• CVE-2019-1224An information disclosure vulnerability exists when the Wind…7.5
• CVE-2019-12240The Virim plugin 0.4 for WordPress allows Insecure Deseriali…
• CVE-2019-12241The Carts Guru plugin 1.4.5 for WordPress allows Insecure De…
• CVE-2019-12243Istio 1.1.x through 1.1.6 has Incorrect Access Control.