CVE-2024-13892
Last modified
CVE-2024-13892 is a high-severity vulnerability rated 7.7/10 on the CVSS scale. Smartwares cameras CIP-37210AT and C724IP, as well as others which share the same firmware in versions up to 3.3.0, are vulnerable to command injection. During the initialization process, a user has to use a mobile app to provide devices with Access Point credentials. EPSS estimates a 0.69% chance of exploitation in the next 30 days.
Description
Smartwares cameras CIP-37210AT and C724IP, as well as others which share the same firmware in versions up to 3.3.0, are vulnerable to command injection. During the initialization process, a user has to use a mobile app to provide devices with Access Point credentials. This input is not properly sanitized, what allows for command injection. The vendor has not replied to reports, so the patching status remains unknown. Newer firmware versions might be vulnerable as well.
Metrics
CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Weakness Enumeration
References
Timeline
- Published
- Last Modified
- Status
- Deferred
Frequently Asked Questions
What is CVE-2024-13892?
How severe is CVE-2024-13892?
How do I fix CVE-2024-13892?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2024
- CVE-2024-13887The Business Directory Plugin – Easy Listing Directories for…5.3
- CVE-2024-13888The WPMobile.App plugin for WordPress is vulnerable to Open …6.1
- CVE-2024-13889The WordPress Importer plugin for WordPress is vulnerable to…7.2
- CVE-2024-1389The Paid Membership Subscriptions – Effortless Memberships, …5.3
- CVE-2024-13890The Allow PHP Execute plugin for WordPress is vulnerable to …7.2
- CVE-2024-13891The Schedule WordPress plugin through 1.0.0 does not sanitis…7.1
- CVE-2024-13893Smartwares cameras CIP-37210AT and C724IP, as well as others…7.5
- CVE-2024-13894Smartwares cameras CIP-37210AT and C724IP, as well as others…5.9
- CVE-2024-13895The The Code Snippets CPT plugin for WordPress is vulnerable…6.3
- CVE-2024-13896The WP-GeSHi-Highlight — rock-solid syntax highlighting for …6.5
- CVE-2024-13897The Moving Media Library plugin for WordPress is vulnerable …6.5
- CVE-2024-13898The Simple Banner – Easily add multiple Banners/Bars/Notific…4.4
Are you affected by CVE-2024-13892?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST