CVE-2024-13892CWE-78

Command Injection in Smartwares cameras

High · published March 6, 2025

CVSS v4.0
7.7
EPSS
1%
Percentile
51.2
In the wild
Unconfirmed
What it is

Smartwares cameras CIP-37210AT and C724IP, as well as others which share the same firmware in versions up to 3.3.0, are vulnerable to command injection.

During the initialization process, a user has to use a mobile app to provide devices with Access Point credentials. This input is not properly sanitized, what allows for command injection.

The vendor has not replied to reports, so the patching status remains unknown. Newer firmware versions might be vulnerable as well.

The record
Technical detail
CVSS v4.0
7.7 · HIGH
Vector
CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
EPSS
0.00665 · 51.2th percentile
Weakness
CWE-78 · Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Published
2025-03-06T14:00Z
EPSS history
Timeline
  • 06 MAR 14:00Z
    Command Injection in Smartwares cameras
    cvelistv5