# CVE-2023-30466

## Summary

- **CVE ID:** CVE-2023-30466
- **Severity:** CRITICAL
- **CVSS Score:** 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
- **CWE:** CWE-640
- **Published:** Apr 28, 2023
- **Last Modified:** Mar 13, 2026

## Description

This vulnerability exists in Milesight 4K/H.265 Series NVR models (MS-Nxxxx-xxG, MS-Nxxxx-xxE, MS-Nxxxx-xxT, MS-Nxxxx-xxH and MS-Nxxxx-xxC), due to a weak password reset mechanism at the Milesight NVR web-based management interface. A remote attacker could exploit this vulnerability by sending a specially crafted http requests on the targeted device.

Successful exploitation of this vulnerability could allow remote attacker to account takeover on the targeted device.

## Affected Products

- Milesight — NVR MS-Nxxxx-xxG (77.X)
- Milesight — NVR MS-Nxxxx-xxE (75.X)
- Milesight — NVR MS-Nxxxx-xxT (72.X)
- Milesight — NVR MS-Nxxxx-xxH  (71.X)
- Milesight — NVR MS-Nxxxx-xxC (73.X)

## References

- [CNA](https://www.cert-in.org.in/s2cMainServlet?pageid=PUBVLNOTES01&VLCODE=CIVN-2023-0121)

## Exploitation Prediction (EPSS)

- **EPSS Score:** 1.13%
- **EPSS Percentile:** 78.0

---
_Exported from OnDuty AI Vulnerability Intelligence on 2026-09-18._