ET EXPLOIT Xiongmai/HiSilicon DVR - OpenTelnet Inbound - Possilbe CVE-2020-22253 Attempt

alert tcp-pkt any any -> $HOME_NET 9530 (
    msg:"ET EXPLOIT Xiongmai/HiSilicon DVR - OpenTelnet Inbound - Possilbe CVE-2020-22253 Attempt";
    flow:established,to_server;
    stream_size:server,<,5;
    flowbits:set,ET.CVE-2020-22253;
    flowbits:noalert;
    dsize:20;
    content:"|13|OpenTelnet:OpenOnce";
    reference:url,habr.com/en/post/486856/;
    reference:url,vulncheck.com/blog/xiongmai-iot-exploitation;
    reference:url,github.com/tothi/hs-dvr-telnet;
    reference:cve,2020-22253;
    classtype:attempted-recon;
    sid:2041646; rev:1;
    metadata:attack_target IoT, created_at 2022_12_02, cve CVE_2020_22253, deployment Perimeter, confidence High, signature_severity Major, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2022_12_02;
)