Command Injection Vulnerability in Lenovo Smart Cameras
CVE-2021-3617

7.2HIGH

Key Information:

Vendor
Lenovo
Status
Smart Camera X3, X5, And C2e Firmware
Vendor
CVE Published:
17 August 2021

Summary

A command injection vulnerability exists in the Lenovo Smart Camera X3, X5, and C2E models, which allows an attacker to exploit a specially crafted network configuration. This security flaw enables potential unauthorized command execution, compromising the integrity and security of the affected devices. Users of these models should remain vigilant and apply necessary updates or mitigations to safeguard their video surveillance systems.

Affected Version(s)

Smart Camera X3, X5, and C2E firmware < 01.03.29.16

References

https://iknow.lenovo.com.cn/detail/dc_198417.html
x_refsource_MISC
https://www.cnvd.org.cn/flaw/show/CNVD-2020-68652
x_refsource_MISC

CVSS V3.1

Score:
7.2
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Lenovo thanks Charles Jiang and Xingcan Chen from Lenovo Global Security Lab for reporting these issues.
.