CVE-2024-48214 Command injection in n/a
An attacker can execute arbitrary code on KERUI Tuya cameras by crafting a malicious QR code for network configuration.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2024-48214?
CVE-2024-48214 is a high-severity command injection vulnerability in n/a, published on 30 Oct 2024. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
KERUI HD 3MP 1080P Tuya Camera 1.0.4 has a command injection vulnerability in the module that connects to the local network via a QR code. This vulnerability allows an attacker to create a custom, unauthenticated QR code and abuse one of the parameters, either SSID or PASSWORD, in the JSON data contained within the QR code. By that, the attacker can execute arbitrary code on the camera.
Weakness: CWE-77
Which versions are affected by CVE-2024-48214?
How do I fix CVE-2024-48214?
No fix has been published for CVE-2024-48214 yet. Limit exposure of the affected software until one is available.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2024-48214 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2024-48214 exists.
Sources
Also known as GHSA-jg9m-4m4c-v7c8.