PT-2024-35369 · Lorex · Lorex 2K Indoor Wi-Fi Security Camera

Stephen Fewer · Published 2024-12-03 · Updated 2024-12-04 · CVE-2024-52548

Positive Technologies (AI Summary)

CVSS v3.1

6.7

Medium

Base vector

AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Lorex 2K Indoor Wi-Fi Security Camera versions prior to 2.800.0000000.8.R.20241111

Description An attacker who can execute arbitrary Operating Systems commands can bypass code signing enforcements in the kernel and execute arbitrary native code. The issue allows manipulation that leads to insufficient data authenticity verification.

Recommendations For versions prior to 2.800.0000000.8.R.20241111, upgrade to version 2.800.0000000.8.R.20241111 or later to resolve the issue. As a temporary workaround, consider restricting access to the kernel to minimize the risk of exploitation.

Exploit

Fix

Insufficient Verification of Data Authenticity

Weakness Enumeration

CWE-345

Related Identifiers

CVE-2024-52548

Affected Products

Lorex 2K Indoor Wi-Fi Security Camera

References · 7

• 🔥 https://github.com/sfewer-r7/LorexExploit · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2024-52548 · Security Note
• https://rapid7.com/blog/post/2024/12/03/lorex-2k-indoor-wi-fi-security-camera-multiple-vulnerabilities-fixed · Note
• https://twitter.com/oktsec/status/1864046683547426944 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1864098081903460638 · Twitter Post
• https://t.me/cvedetector/11891 · Telegram Post
• https://twitter.com/CVEnew/status/1864004334641451176 · Twitter Post