CVE-2024-22028 Information disclosure in 3R-TMC01
An attacker with physical access can retrieve internal data from thermal cameras due to insufficient documentation of stored information.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2024-22028?
CVE-2024-22028 is a medium-severity vulnerability in THREE R SOLUTION CORP. JAPAN 3R-TMC01, published on 15 Jan 2024. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
Insufficient technical documentation issue exists in thermal camera TMC series all firmware versions. The user of the affected product is not aware of the internally saved data. By accessing the affected product physically, an attacker may retrieve the internal data.
Which versions are affected by CVE-2024-22028?
It affects 6 products.
Products include 3rrr-Btob 3r-Tmc01 Firmware, 3rrr-Btob 3r-Tmc02 Firmware, 3rrr-Btob 3r-Tmc03 Firmware, 3rrr-Btob 3r-Tmc04 Firmware, 3rrr-Btob 3r-Tmc05 Firmware, 3rrr-Btob 3r-Tmc06 Firmware.
How do I fix CVE-2024-22028?
No fix has been published for CVE-2024-22028 yet. Limit exposure of the affected software until one is available.
Is CVE-2024-22028 being exploited?
There is no known exploitation of CVE-2024-22028 in the wild and no public exploit code.
Sources
Also known as GHSA-53hc-55fr-f547.