CVE-2023-5038 is a high severity (CVSS 7.5) unauthenticated denial of service in Hanwha Vision network cameras. A crafted URL makes the web management page unavailable until the device is restarted. Hanwha released patch firmware, for example 1.41.16 and later on the ANO-L6012R, so check your model.
What's affected
The NVD record says a security researcher found a flaw that allows an unauthenticated denial of service attack on the camera. After a crafted URL is requested, nobody can reach the web management page, and the device must be restarted by hand or powered off and on again.
Hanwha Vision published a report in June 2024 covering CVE-2023-5037 and CVE-2023-5038, with a table of affected models. It says the researcher reported the issues to Hanwha on 12 July 2023. It rates CVE-2023-5038 as High and the related CVE-2023-5037, an authenticated command injection, as Middle.
The corrected firmware depends on the model line. In the report, the ANO, ANV, ANE and QN families list corrected firmware 1.41.16 and later, the LN family lists 1.41.13 and later, and the PNM family lists 2.22.00 to 2.22.02 and later depending on the model. Always read the row for your exact model, because the numbers differ.
How to check if you're exposed
Log in to each camera or to your video management system, and read the firmware version on the device information page.
Compare the version with the row for your model in the Hanwha Vision report. A version below the corrected one means the camera is affected.
Check who can reach the camera web interface. Cameras on a flat network, or exposed through port forwarding, can be knocked offline by anyone who can send the request.
If you have a large estate, export firmware versions from your management software and sort by model.
What to do now
- List all Hanwha Vision cameras by model and firmware.
- Download the corrected firmware from Hanwha Vision and test it on one device first.
- Roll the update out in batches, and keep a recovery plan for each site.
- Keep camera management interfaces off the internet and behind a firewall or VPN.
- Segment cameras onto their own network so an outage of one device does not become a wider issue.
Why it matters
The record lists two classes, CWE-248, CWE-703: an uncaught exception and improper check or handling of exceptional conditions. Hanwha says an error in the web service caused the exception handling logic to run improperly when it received a crafted URL.
A camera that stops answering is a gap in video coverage, and the fix on site means somebody has to restart it by hand. That is why availability bugs on physical security gear deserve real attention. The record does not claim exploitation and the CVE is not in the CISA KEV catalog.
Quick check
Does the attacker need a password?
No. The record says the denial of service is unauthenticated. The related CVE-2023-5037 is the one that needs credentials.
Sources
Last reviewed: 19 October 2026.
