Critical · 9.8 CVE-2023-7227 EUVD-2023-59408GHSA-6485-hpmh-6q3r

Command Injection vulnerability in SystemK NVR 504/508/516

Published Jan 25, 2024 · Updated May 29, 2025 · Assigned by icscert

Vendor: SystemK Product: NVR 504 Product: NVR 508 Product: NVR 516

Description

SystemK NVR 504/508/516 versions 2.3.5SK.30084998 and prior are vulnerable to a command injection vulnerability in the dynamic domain name system (DDNS) settings that could allow an attacker to execute arbitrary commands with root privileges.

Affected products

Vendor	Product	Affected	Fixed
SystemK	NVR 504	2.3.5SK.30084998	—
SystemK	NVR 508	2.3.5SK.30084998	—
SystemK	NVR 516	2.3.5SK.30084998	—

Advisories 1

ICSA-24-025-02 SystemK NVR 504/508/516 CISA ICS & IT advisories · Jan 25, 2024

References

https://www.cisa.gov/news-events/ics-advisories/icsa-24-025-02 government-resource