Full Report
CERT Polska has received a report about 3 vulnerabilities (from CVE-2024-13892 to CVE-2024-13894) found in Smartwares cameras.
Analysis Summary
# Vulnerability: Multiple Vulnerabilities in Smartwares Cameras (CVE-2024-13892 to CVE-2024-13894)
## CVE Details
- CVE ID: CVE-2024-13892
- CVSS Score: N/A (Scoring not provided in source excerpt)
- CWE: CWE-77 (Improper Neutralization of Special Elements used in a Command ('Command Injection'))
- CVE ID: CVE-2024-13893
- CVSS Score: N/A (Scoring not provided in source excerpt)
- CWE: CWE-1392 (Use of Default Credentials)
- CVE ID: CVE-2024-13894
- CVSS Score: N/A (Scoring not provided in source excerpt)
- CWE: CWE-22 (Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'))
## Affected Systems
- Products: Smartwares CIP-37210AT and C724IP cameras
- Versions: All through 3.3.0
- Configurations:
- **CVE-2024-13893:** Telnet service must be enabled (requires creating a specific folder on the inserted SD card).
## Vulnerability Description
Three vulnerabilities were reported in the firmware of Smartwares cameras:
1. **CVE-2024-13892 (Command Injection):** During the mobile app initialization phase where Access Point credentials are provided, this input is not properly sanitized, allowing an attacker to inject arbitrary operating system commands.
2. **CVE-2024-13893 (Default Credentials):** Affected devices share the same credentials for the telnet service. The password hash can be retrieved via physical access to SPI-connected memory.
3. **CVE-2024-13894 (Path Traversal):** When connected to the mobile app, the device opens port 10000, allowing users to download pictures by providing file paths. Directory limitations are insufficient, enabling path traversal to download sensitive files.
## Exploitation
- Status: No specific exploitation status (in the wild or PoC) is detailed, but exploitation is highly feasible given the nature of the flaws.
- Complexity:
- CVE-2024-13892: Likely Low/Medium (requires successful mobile setup phase interaction).
- CVE-2024-13893: Medium/High (requires physical access to retrieve memory/hash).
- CVE-2024-13894: Likely Low (Port 10000 is opened when connected to the app).
- Attack Vector:
- CVE-2024-13892: Network (via configuration process).
- CVE-2024-13893: Physical (for hash retrieval, but Telnet service exposure is network-based).
- CVE-2024-13894: Network (via Port 10000 when connected to the app).
## Impact
Impact levels are inferred based on CWE definitions, as official CVSS scores were not provided:
- Confidentiality: High (Command Injection, Path Traversal leading to sensitive data exposure)
- Integrity: High (Command Injection allows system modification)
- Availability: Medium (Potential for denial of service via Command Injection)
## Remediation
### Patches
- No patches or fixed versions were provided by the vendor as they have not responded to the report. Newer firmware versions *might* still be vulnerable.
### Workarounds
- **CVE-2024-13893 Specific:** Ensure the SD card does *not* have the specific folder required to enable the telnet service.
- **General:** Monitor network traffic for unusual connections to Port 10000 (CVE-2024-13894) if the application is in use.
- **General:** If possible, restrict network access to the cameras to trusted interfaces only.
## Detection
- **CVE-2024-13892:** Monitor device initialization logs or network calls for unrecognized command arguments being passed during setup.
- **CVE-2024-13893:** Scan the local network for devices running an accessible Telnet service (port 23). Attempt connection using default credentials.
- **CVE-2024-13894:** Monitor outbound connections originating from the device on TCP port 10000, especially requests containing directory traversal sequences (`../`) in file path parameters.
- **Detection methods and tools:** Network traffic analysis tools (e.g., Wireshark) or network intrusion detection systems (NIDS) monitoring suspicious commands or abnormal file access patterns.
## References
- Vendor advisories: None available; vendor has not replied to the report.
- Relevant links - defanged:
- hxxps://incydent.cert.pl/#!/lang=en
- hxxps://cert.pl/en/publications/
- hxxps://cert.pl/en/cve
- hxxps://www.cve.org/CVERecord?id=CVE-2024-13892
- hxxps://www.cve.org/CVERecord?id=CVE-2024-13893
- hxxps://www.cve.org/CVERecord?id=CVE-2024-13894