CVE-2024-52546 Lorex 2K Indoor Wi-Fi Security Camera - Null pointer dereference
An unauthenticated attacker can cause a denial of service via null pointer dereference in the DHIP service of Lorex security cameras.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2024-52546?
CVE-2024-52546 is a medium-severity vulnerability in Lorex 2K Indoor Wi-Fi Security Camera, published on 3 Dec 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
An unauthenticated attacker can perform a null pointer dereference in the DHIP Service (UDP port 37810). This vulnerability has been resolved in firmware version 2.800.0000000.8.R.20241111.
Weakness: CWE-476
Which versions are affected by CVE-2024-52546?
How do I fix CVE-2024-52546?
No fix has been published for CVE-2024-52546 yet. Limit exposure of the affected software until one is available.
Is CVE-2024-52546 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2024-52546 exists.
Sources
Also known as GHSA-gjcw-vmfm-pc8c.