mirror of
https://github.com/fkie-cad/nvd-json-data-feeds.git
synced 2025-05-28 09:11:28 +00:00
86 lines
3.8 KiB
JSON
86 lines
3.8 KiB
JSON
{
|
|
"id": "CVE-2024-13892",
|
|
"sourceIdentifier": "cvd@cert.pl",
|
|
"published": "2025-03-06T14:15:35.453",
|
|
"lastModified": "2025-03-06T14:15:35.453",
|
|
"vulnStatus": "Awaiting Analysis",
|
|
"cveTags": [],
|
|
"descriptions": [
|
|
{
|
|
"lang": "en",
|
|
"value": "Smartwares cameras\u00a0CIP-37210AT and\u00a0C724IP, as well as others which share the same firmware in versions up to 3.3.0, are vulnerable to command injection. \nDuring the initialization process, a user has to use a mobile app to provide devices with Access Point credentials. This input is not properly sanitized, what allows for command injection.\nThe vendor has not replied to reports, so the patching status remains unknown. Newer firmware versions might be vulnerable as well."
|
|
},
|
|
{
|
|
"lang": "es",
|
|
"value": "Smartwares cameras CIP-37210AT y C724IP, as\u00ed como otras que comparten el mismo firmware en versiones hasta la 3.3.0, son vulnerables a la inyecci\u00f3n de comandos. Durante el proceso de inicializaci\u00f3n, un usuario tiene que usar una aplicaci\u00f3n m\u00f3vil para proporcionar a los dispositivos las credenciales del punto de acceso. Esta entrada no est\u00e1 debidamente depurada, lo que permite la inyecci\u00f3n de comandos. El proveedor no ha respondido a los informes, por lo que el estado de la aplicaci\u00f3n de parches sigue siendo desconocido. Las versiones de firmware m\u00e1s nuevas tambi\u00e9n podr\u00edan ser vulnerables."
|
|
}
|
|
],
|
|
"metrics": {
|
|
"cvssMetricV40": [
|
|
{
|
|
"source": "cvd@cert.pl",
|
|
"type": "Secondary",
|
|
"cvssData": {
|
|
"version": "4.0",
|
|
"vectorString": "CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
|
|
"baseScore": 7.7,
|
|
"baseSeverity": "HIGH",
|
|
"attackVector": "ADJACENT",
|
|
"attackComplexity": "LOW",
|
|
"attackRequirements": "PRESENT",
|
|
"privilegesRequired": "NONE",
|
|
"userInteraction": "NONE",
|
|
"vulnConfidentialityImpact": "HIGH",
|
|
"vulnIntegrityImpact": "HIGH",
|
|
"vulnAvailabilityImpact": "HIGH",
|
|
"subConfidentialityImpact": "NONE",
|
|
"subIntegrityImpact": "NONE",
|
|
"subAvailabilityImpact": "NONE",
|
|
"exploitMaturity": "NOT_DEFINED",
|
|
"confidentialityRequirement": "NOT_DEFINED",
|
|
"integrityRequirement": "NOT_DEFINED",
|
|
"availabilityRequirement": "NOT_DEFINED",
|
|
"modifiedAttackVector": "NOT_DEFINED",
|
|
"modifiedAttackComplexity": "NOT_DEFINED",
|
|
"modifiedAttackRequirements": "NOT_DEFINED",
|
|
"modifiedPrivilegesRequired": "NOT_DEFINED",
|
|
"modifiedUserInteraction": "NOT_DEFINED",
|
|
"modifiedVulnConfidentialityImpact": "NOT_DEFINED",
|
|
"modifiedVulnIntegrityImpact": "NOT_DEFINED",
|
|
"modifiedVulnAvailabilityImpact": "NOT_DEFINED",
|
|
"modifiedSubConfidentialityImpact": "NOT_DEFINED",
|
|
"modifiedSubIntegrityImpact": "NOT_DEFINED",
|
|
"modifiedSubAvailabilityImpact": "NOT_DEFINED",
|
|
"Safety": "NOT_DEFINED",
|
|
"Automatable": "NOT_DEFINED",
|
|
"Recovery": "NOT_DEFINED",
|
|
"valueDensity": "NOT_DEFINED",
|
|
"vulnerabilityResponseEffort": "NOT_DEFINED",
|
|
"providerUrgency": "NOT_DEFINED"
|
|
}
|
|
}
|
|
]
|
|
},
|
|
"weaknesses": [
|
|
{
|
|
"source": "cvd@cert.pl",
|
|
"type": "Secondary",
|
|
"description": [
|
|
{
|
|
"lang": "en",
|
|
"value": "CWE-77"
|
|
}
|
|
]
|
|
}
|
|
],
|
|
"references": [
|
|
{
|
|
"url": "https://cert.pl/en/posts/2025/03/CVE-2024-13892/",
|
|
"source": "cvd@cert.pl"
|
|
},
|
|
{
|
|
"url": "https://www.smartwares.eu/en-gb/smartwares-cip-37210at-indoor-wi-fi-camera-cip--37210at",
|
|
"source": "cvd@cert.pl"
|
|
}
|
|
]
|
|
} |