LG Innotek LNV5110R Camera Authentication Vulnerability Allowing Remote Code Execution

An authentication vulnerability has been identified in the LG Innotek camera model LNV5110R, all firmware versions. This vulnerability allows a malicious actor to upload an HTTP POST request to the device's non-volatile storage, potentially leading to remote code execution. Exploitation of this vulnerability would enable an attacker to execute arbitrary commands on the device with administrative privileges.

Impact

Exploitation of this vulnerability could result in unauthorized administrative access to the affected camera, allowing for arbitrary code execution with elevated privileges.

Remediation

LG Innotek has acknowledged this vulnerability but stated that the LNV5110R model is an end-of-life product that cannot be patched. Users are advised to consult the LG Security Center for further guidance.