PT-2025-9925 · Smartwares · Smartwares Cameras

Marcin Wyczechowski + 2 · Published 2025-03-06 · Updated 2025-03-07 · CVE-2024-13894

Positive Technologies (AI Summary)

CVSS v4.0

5.9

Medium

Base vector

AV:L/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Smartwares cameras versions up to 3.3.0

Description The issue allows for path traversal attacks, enabling access to sensitive information by manipulating file paths. When connected to a mobile app, affected devices open port 10000, allowing users to download pictures by providing specific file paths. However, the directories accessible to users are not properly restricted, facilitating the path traversal attacks. The vendor has not responded to reports, and the patching status is unknown.

Recommendations For versions up to 3.3.0, as a temporary workaround, consider restricting access to port 10000 when not in use, to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

BDU:2025-02435

CVE-2024-13894

Affected Products

Smartwares Cameras

References · 7

• https://bdu.fstec.ru/vul/2025-02435 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2024-13894 · Security Note
• https://smartwares.eu/en-gb/smartwares-cip-37210at-indoor-wi-fi-camera-cip--37210at · Note
• https://twitter.com/VulmonFeeds/status/1897656541135667553 · Twitter Post
• https://smartwares.eu/en-gb/smartwares-products/camera-systems/ip-cameras/smartwares-10-018-19-ip-camera-indoor-c724ip-10.018.19 · Note
• https://cert.pl/en/posts/2025/03/CVE-2024-13892 · Note
• https://twitter.com/CVEnew/status/1897878712382628323 · Twitter Post