Smartwares Cameras Command Injection Vulnerability

A command injection vulnerability has been identified in Smartwares cameras CIP-37210AT and C724IP, as well as other models sharing the same firmware, all through version 3.3.0. The vulnerability arises during the initialization process when users input Access Point credentials via a mobile app. This input is not properly sanitized, allowing for command injection. The vendor has not responded to reports, leaving the patching status unknown, and newer firmware versions may also be vulnerable.

Impact

Exploitation of this vulnerability allows for command injection, where an attacker can execute arbitrary commands on the device.