CVE-2022-38399 Command injection in SmaCam CS-QR10 and SmaCam Night Vision CS-QR20
Attackers with physical access to the serial interface can execute arbitrary OS commands on SmaCam security cameras due to missing authentication.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2022-38399?
CVE-2022-38399 is a medium-severity command injection vulnerability in PLANEX COMMUNICATIONS INC. SmaCam CS-QR10 and SmaCam Night Vision CS-QR20, published on 8 Sep 2022. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
Missing protection mechanism for alternate hardware interface in SmaCam CS-QR10 all versions and SmaCam Night Vision CS-QR20 all versions allows an attacker to execute an arbitrary OS command by having the product connect to the product's specific serial connection
Weakness: CWE-287
Which versions are affected by CVE-2022-38399?
It affects 2 products.
Products include Planex Cs-Qr10 Firmware, Planex Cs-Qr20 Firmware.
How do I fix CVE-2022-38399?
No fix has been published for CVE-2022-38399 yet. Limit exposure of the affected software until one is available.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2022-38399 being exploited?
There is no known exploitation of CVE-2022-38399 in the wild and no public exploit code.
Other vulnerabilities in PLANEX COMMUNICATIONS INC. SmaCam CS-QR10 and SmaCam Night Vision CS-QR20
Sources
Also known as GHSA-xr2c-mghr-gmr2.