Paper/Archive/CVE-2024-48538

CVE-2024-48538

netdvr neye3c — Incorrect access control in the firmware update and download processes of Neye3C v4.5.2.0 allows attackers to access sensitive informatio…

EPSS 0.5%public exploit CVSS 9.8

critical.is priorityof 100

CVSS 9.8 (ADP)9.8 / 10 × 3029.4 Not in CISA KEV+300.0 EPSS percentile 42.2.422 × 208.4 Exploit: SSVC poc+1010.0 SSVC exploitation: poc+100.0

Description · from the CVE record

Incorrect access control in the firmware update and download processes of Neye3C v4.5.2.0 allows attackers to access sensitive information by analyzing the code and data within the APK file.

Affected

ProductAffectedFixed inSource

n/an/a–CNA

neye3c4.5.2.0–CISA-ADP

Scores by source

CISA ADP9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CISA ADPSSVCExploitation: poc · Automatable: yes · Technical impact: total

References

refnetdvr.cn/page6 refgithub.com/HankJames/Vul-Reports/blob/main/FirmwareLeakage/com.gooclient.anycam.neye3ctwo/com.gooclient.anycam.neye3ctwo.md