CVE-2024-3850 is a reflected cross-site-scripting vulnerability (CWE-79) in the web management interface of Uniview's NVR301-04S2-P4 network video recorder: an attacker can send an already-authenticated user a specially crafted URL that, if clicked, executes attacker-controlled JavaScript in that user's browser session on the recorder's management page; exploitation requires the victim to be logged in and to click the malicious link, which limits scope and severity, and NVD has published its own Primary CVSS v3.1 score of 5.4 (medium) for the flaw.
Vulnerability summary
5.4
Medium
0.9%
EPSS score (FIRST)
No
CISA KEV catalog
2024-06-10
Published
Vulnerability ID: CVE-2024-3850 · Source: NVD
Affected components
| Component | CPE | Version range |
|---|---|---|
| Uniview NVR301-04S2-P4 network video recorder | — | Firmware prior to NVR-B3801.20.17.240507; fixed in NVR-B3801.20.17.240507 |
What does this mean for affected devices?
CVE-2024-3850 (CWE-79, improper neutralization of input during web page generation) affects Uniview's NVR301-04S2-P4 network video recorder. NVD's description states: "Uniview NVR301-04S2-P4 is vulnerable to reflected cross-site scripting attack (XSS). An attacker could send a user a URL that if clicked on could execute malicious JavaScript in their browser. This vulnerability also requires authentication before it can be exploited, so the scope and severity is limited. Also, even if JavaScript is executed, no additional benefits are obtained" (NVD).
NVD lists the CVE's status as "Modified" with its own Primary CVSS v3.1 base score of 5.4 (medium), vector CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N, matching a Secondary score submitted by CISA's ICS-CERT; NVD also carries a CVSS v4.0 score of 4.8 (NVD).
CISA's advisory ICSA-24-156-01, first published 2024-06-04 and updated 2024-09-24, states that CISA identified a public proof-of-concept exploit authored by security researcher Bleron Rrustemi and reported it to Uniview, with Chapman Schleiss of Test Defense separately reporting an update on the issue to CISA; the advisory lists the affected version as NVR301-04S2-P4 firmware prior to NVR-B3801.20.17.240507 and recommends operators obtain the fixed version from Uniview (CISA ICS Advisory ICSA-24-156-01).
This CVE is not listed in the CISA Known Exploited Vulnerabilities catalog as of catalog version 2026.11.06, despite a public proof-of-concept being available, and FIRST scores the probability of exploitation at 0.0091 (60.2th percentile) as of 2026-11-07 (CISA KEV, FIRST EPSS).
CISA's general guidance for this class of network-video-recorder exposure — minimizing network exposure for control-system and surveillance devices, placing them behind firewalls, and isolating them from business networks, using VPNs for any necessary remote access rather than exposing management interfaces directly — applies to any NVR301-04S2-P4 deployment still running pre-patch firmware (CISA ICS Advisory ICSA-24-156-01).
Any Uniview NVR301-04S2-P4 unit running firmware older than NVR-B3801.20.17.240507 should be updated, and administrators should be cautious about clicking links while logged into the recorder's web management interface.
Evidence
- Uniview NVR301-04S2-P4 is vulnerable to reflected XSS; an attacker could send a user a URL that, if clicked, executes malicious JavaScript in their browser; requires authentication, limiting scope and severity. — NVD
- NVD status 'Modified'; NVD Primary CVSS v3.1 base score 5.4, vector CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N, matching CISA's Secondary submission; CVSS v4.0 score 4.8. — NVD
- CISA identified a public PoC by Bleron Rrustemi and reported it to Uniview; Chapman Schleiss of Test Defense reported an update; affected version is firmware prior to NVR-B3801.20.17.240507; advisory published 2024-06-04, updated 2024-09-24. — CISA ICS Advisory ICSA-24-156-01
- Not present in the CISA KEV catalog as of catalog version 2026.11.06; EPSS score is 0.0091 (60.2th percentile) as of 2026-11-07. — FIRST EPSS
Questions about this page?
Related advisories
Sources
Frequently asked questions
What does an attacker need to do to exploit CVE-2024-3850?
The attacker must get an already-authenticated user of the Uniview NVR301-04S2-P4's web management interface to click a specially crafted URL; the reflected XSS payload then executes attacker-controlled JavaScript in that user's browser session (per NVD and CISA ICS Advisory ICSA-24-156-01).
Why is CVE-2024-3850 rated only medium severity despite affecting a security recorder?
NVD's own description notes the vulnerability requires authentication before it can be exploited, 'so the scope and severity is limited,' and that executing the JavaScript provides no additional benefit to the attacker beyond the browser context — reflected in NVD's Primary CVSS v3.1 score of 5.4 (per NVD).
How can I fix an affected Uniview NVR301-04S2-P4?
CISA's advisory recommends updating to firmware NVR-B3801.20.17.240507 or later, and more generally minimizing network exposure of recorder management interfaces and using a VPN rather than exposing them directly to untrusted networks (per CISA ICS Advisory ICSA-24-156-01).