PT-2024-16782 · Tcl · Tcl Camera

Szymon Chadam · Published 2024-11-14 · Updated 2024-11-17 · CVE-2024-11136

Positive Technologies (AI Summary)

CVSS v4.0

8.2

High

Base vector

AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Name of the Vulnerable Software and Affected Versions TCL products (affected versions not specified)

Description The default TCL Camera application has a path traversal vulnerability in its provider. A malicious application can supply a malicious URI path, allowing it to delete arbitrary files from the user's external storage. There have been reports of this issue being exploited for remote code execution in specific TCL product models.

Recommendations Update to the latest firmware as detailed in the advisory to resolve the issue. As a temporary workaround, consider restricting access to the TCL Camera application's provider to minimize the risk of exploitation. Ensure you follow the remediation guidelines provided to mitigate risks associated with this issue. At the moment, there is no information about specific versions that contain a fix for this vulnerability, so updating to the latest firmware is the recommended course of action.

Fix

Weakness Enumeration

CWE-35

Related Identifiers

CVE-2024-11136

Affected Products

Tcl Camera

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2024-11136 · Security Note
• https://blog.oversecured.com/Content-Providers-and-the-potential-weak-spots-they-can-have/#path-traversal-when-using-data-from-uri · Note
• https://twitter.com/transilienceai/status/1858016579440586813 · Twitter Post
• https://cert.pl/en/posts/2024/11/CVE-2024-11136 · Note
• https://twitter.com/transilienceai/status/1858016572985512419 · Twitter Post
• https://cert.pl/posts/2024/11/CVE-2024-11136 · Note
• https://twitter.com/CVEnew/status/1857086255185416291 · Twitter Post
• https://t.me/cvedetector/10970 · Telegram Post