CVE-2024-54012
Last modified
CVE-2024-54012 is a medium-severity vulnerability rated 5.3/10 on the CVSS scale. Penetration Testing engineers at Amazon discovered a vulnerability where the camera system failed to properly validate input, allowing specially crafted requests containing malicious commands to be executed on the device. The manufacturer has released patch firmware for the flaw; please refer to the manufacturer's report for details and workarounds.. EPSS estimates a 0.16% chance of exploitation in the next 30 days.
Description
Penetration Testing engineers at Amazon discovered a vulnerability where the camera system failed to properly validate input, allowing specially crafted requests containing malicious commands to be executed on the device. The manufacturer has released patch firmware for the flaw; please refer to the manufacturer's report for details and workarounds.
Metrics
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
CVSS:4.0/AV:A/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Hanwhavision | Knb-2000 Firmware | < 2.23.01 |
| Hanwhavision | Knb-5000n Firmware | < 2.23.01 |
| Hanwhavision | Knd-2010 Firmware | < 2.23.01 |
| Hanwhavision | Knd-2020rn Firmware | < 2.23.01 |
| Hanwhavision | Knd-2080rn Firmware | < 2.23.01 |
| Hanwhavision | Knd-5020rn Firmware | < 2.23.01 |
| Hanwhavision | Knd-5080rn Firmware | < 2.23.01 |
| Hanwhavision | Kno-2010rn Firmware | < 2.23.01 |
| Hanwhavision | Kno-2080rn Firmware | < 2.23.01 |
| Hanwhavision | Kno-2120rn Firmware | < 2.23.01 |
| Hanwhavision | Kno-5020rn Firmware | < 2.23.01 |
| Hanwhavision | Kno-5080rn Firmware | < 2.23.01 |
| Hanwhavision | Knp-2120hn Firmware | < 2.23.01 |
| Hanwhavision | Knp-2320rh Firmware | < 2.23.01 |
| Hanwhavision | Knp-2320rha Firmware | < 2.23.01 |
| Hanwhavision | Knp-2550rha Firmware | < 2.23.01 |
| Hanwhavision | Pnd-A6081rv Firmware | < 2.23.01 |
| Hanwhavision | Pnd-A9081rv Firmware | < 2.23.01 |
| Hanwhavision | Pnm-7000vd Firmware | < 2.23.00 |
| Hanwhavision | Pnm-7002vd Firmware | < 2.23.00 |
| Hanwhavision | Pnm-9000vd Firmware | < 2.23.00 |
| Hanwhavision | Pnm-9000vq Firmware | < 2.23.00 |
| Hanwhavision | Pnm-9002vq Firmware | < 2.23.00 |
| Hanwhavision | Pnm-9080vq Firmware | < 2.23.00 |
| Hanwhavision | Pnm-9081vq Firmware | < 2.23.00 |
| Hanwhavision | Pnm-9084qz Firmware | < 2.23.00 |
| Hanwhavision | Pnm-9084qz1 Firmware | < 2.23.00 |
| Hanwhavision | Pnm-9084rqz Firmware | < 2.23.00 |
| Hanwhavision | Pnm-9084rqzt Firmware | < 2.23.00 |
| Hanwhavision | Pnm-9085rqz Firmware | < 2.23.00 |
| Hanwhavision | Pnm-9085rqzt Firmware | < 2.23.00 |
| Hanwhavision | Pnm-9320vqp Firmware | < 2.23.00 |
| Hanwhavision | Pnm-9321vqp Firmware | < 2.23.00 |
| Hanwhavision | Pnm-9322vqp Firmware | < 2.23.00 |
| Hanwhavision | Pnv-A6081r Firmware | < 2.23.01 |
| Hanwhavision | Pnv-A9081r Firmware | < 2.23.01 |
| Hanwhavision | Qnd-C8013r Firmware | < 2.22.10 |
| Hanwhavision | Qnd-C8023r Firmware | < 2.22.10 |
| Hanwhavision | Qne-C8013rl Firmware | < 2.22.10 |
| Hanwhavision | Qne-C9013rl Firmware | < 2.22.10 |
| Hanwhavision | Qnf-8010 Firmware | < 2.10.03 |
| Hanwhavision | Qnf-C9010 Firmware | < 2.22.10 |
| Hanwhavision | Qnf-C9010v Firmware | < 2.22.10 |
| Hanwhavision | Qno-C6083r Firmware | < 2.22.10 |
| Hanwhavision | Qno-C8013r Firmware | < 2.22.10 |
| Hanwhavision | Qno-C8023r Firmware | < 2.22.10 |
| Hanwhavision | Qno-C8083r Firmware | < 2.22.10 |
| Hanwhavision | Qno-C9083r Firmware | < 2.22.10 |
| Hanwhavision | Qnp-6230 Firmware | < 2.23.01 |
| Hanwhavision | Qnp-6230h Firmware | < 2.23.01 |
Showing 50 of 253 affected configurations. See NVD for the full list.
References
Timeline
- Published
- Last Modified
- Status
- Analyzed
Frequently Asked Questions
What is CVE-2024-54012?
How severe is CVE-2024-54012?
How do I fix CVE-2024-54012?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2024
- CVE-2024-54007Multiple command injection vulnerabilities exist in the web …7.2
- CVE-2024-54008An authenticated Remote Code Execution (RCE) vulnerability e…7.2
- CVE-2024-54009Remote authentication bypass vulnerability in HPE Alletra St…4
- CVE-2024-5401Improper control of dynamically-managed code resources vulne…8.8
- CVE-2024-54010A vulnerability in the firewall component of HPE Aruba Netwo…3.4
- CVE-2024-54011Penetration Testing engineers at Amazon have discovered a fl…6.5
- CVE-2024-54013Penetration Testing engineers at Amazon have identified a se…8.8
- CVE-2024-54014Improper authorization in handler for custom URL scheme issu…3.6
- CVE-2024-54015A vulnerability has been identified in SIPROTEC 5 6MD84 (CP3…8.7
- CVE-2024-54016Improper Handling of Highly Compressed Data (Data Amplificat…4.3
- CVE-2024-54017A vulnerability has been identified in SIPROTEC 5 6MD84 (CP3…6.9
- CVE-2024-54018Multiple improper neutralization of special elements used in…7.2
Are you affected by CVE-2024-54012?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST