Telnet Credential Vulnerability in Smartwares Cameras

CVE-2024-13893

What is CVE-2024-13893?

Smartwares cameras, including models CIP-37210AT and C724IP, exhibit a vulnerability where shared telnet service credentials can be compromised. This occurs in firmware versions up to 3.3.0, with the password hashes retrievable via physical access to the SPI connected memory. The telnet service can be activated by creating a specially named folder on the inserted SD card. The absence of a response from the vendor regarding reports raises concerns about the patching status and the potential for other devices with similar firmware to harbor the same vulnerability. Users are advised to remain vigilant as newer firmware versions may also be at risk.

References