PT-2024-31260 · Pi Camera · Pi Camera

Published 2024-09-03 · Updated 2024-09-07 · CVE-2024-44809

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Pi Camera project version 1.0

Description A remote code execution (RCE) vulnerability exists due to improper sanitization of user input passed to the position GET parameter in the tilt.php script. An attacker can exploit this by sending crafted input data that includes malicious command sequences, allowing arbitrary commands to be executed on the server with the privileges of the web server user. This issue poses significant risk if the application is exposed to untrusted networks.

Recommendations For Pi Camera project version 1.0, update the software to a patched version as soon as possible and review logs for indicators of compromise. As a temporary workaround, consider restricting access to the tilt.php script to minimize the risk of exploitation. Avoid using the position parameter in the tilt.php script until the issue is resolved.

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2024-44809

Affected Products

Pi Camera

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2024-44809 · Security Note
• https://github.com/recantha/camera-pi/blob/ef018d212288cb16404f0b050593d20f0dc0467b/www/tilt.php#L4 · Note
• https://jacobmasse.medium.com/cve-2024-44809-remote-code-execution-in-raspberry-pi-camera-project-4b8e3486a628 · Note
• https://twitter.com/cracbot/status/1832660241709986241 · Twitter Post
• https://t.me/cvedetector/4731 · Telegram Post
• https://twitter.com/CVEnew/status/1831081962200551523 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1831132746162249963 · Twitter Post
• https://twitter.com/oktsec/status/1831214111448793589 · Twitter Post