Unauthenticated attacker can trigger stack based buffer overflow vulnerability
CVE-2024-52544

9.8CRITICAL

Key Information:

Vendor

Lorex

Status
2k Indoor Wi-fi Security Camera
Vendor
CVE Published:
3 December 2024

Badges

👾 Exploit Exists

What is CVE-2024-52544?

An unauthenticated attacker can exploit a stack-based buffer overflow vulnerability in the DP Service on Lorex 2K Indoor Wi-Fi Security Cameras via TCP port 3500. This exploit can potentially allow unauthorized access or control of the device. Users are advised to upgrade their firmware to version 2.800.0000000.8.R.20241111 or later to mitigate this risk.

Affected Version(s)

2K Indoor Wi-Fi Security Camera 0 < 2.800.0000000.8.R.20241111

References

https://github.com/sfewer-r7/LorexExploit
exploit
https://www.rapid7.com/blog/post/2024/12/03/lorex-2k-indo...
third-party-advisory

CVSS V3.1

Score:
9.8
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • Vulnerability published

.