Loading vulnerability…
Unauthenticated OS Command Execution in UNIMO UDR-JA Series DVR Web Interface
CVE-2022-35733 is a missing authentication for critical function vulnerability affecting UNIMO Technology digital video recorders, specifically UDR-JA1004, UDR-JA1008, and UDR-JA1016 devices running firmware v1.0.20.13 and earlier, and UDR-JA1016 devices running firmware v2.0.20.13 and earlier. The flaw is exposed through the device web interface and allows a remote, unauthenticated attacker to send a specially crafted request that results in execution of arbitrary operating system commands on the underlying device. The vulnerability is therefore an authentication bypass on a critical administrative function that directly leads to remote command execution on the DVR.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation allows full remote compromise of the affected DVR from the network without prior authentication. An attacker can execute arbitrary OS commands on the device, which can enable takeover of the appliance, deployment of malware or botnet payloads, alteration of device configuration, surveillance disruption, use of the device as a relay or proxy node, and participation in follow-on activity such as distributed denial-of-service operations or lateral movement from the compromised edge device.
If you can’t patch tonight, do this now.
Until patched firmware can be deployed, restrict access to the DVR web interface to trusted management networks only, remove direct internet exposure, place devices behind firewall or VPN controls, and disable unnecessary remote administration paths where operationally feasible. Monitor for unexpected command execution, configuration changes, or signs of botnet enrollment on affected DVRs. Because exploitation is unauthenticated and has been observed in botnet propagation, exposed devices should be treated as high priority for isolation and review.
Patch, then assume compromise.
Upgrade affected UNIMO DVR firmware to a fixed version later than v1.0.20.13 for UDR-JA1004, UDR-JA1008, and applicable UDR-JA1016 firmware branches, and later than v2.0.20.13 for affected UDR-JA1016 devices. If vendor-fixed firmware is available, it should be applied immediately across all exposed devices. Asset owners should also inventory internet-exposed DVRs, verify model and firmware branch, and replace unsupported devices that cannot receive security updates.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
5 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.