CVE-2024-48538

CRITICAL

Neye3C 4.5.2.0 - Missing Authorization for Firmware Update and Download

Title source: llm

Description

Incorrect access control in the firmware update and download processes of Neye3C v4.5.2.0 allows attackers to access sensitive information by analyzing the code and data within the APK file.

References (3)

Core 3

Core References

Various Sources

http://www.netdvr.cn/page6

Various Sources

http://neye3c.com

Various Sources

https://github.com/HankJames/Vul-Reports/blob/main/FirmwareLeakage/com.gooclient.anycam.neye3ctwo/com.gooclient.anycam.neye3ctwo.md

View Writeup ZIP pw:eip

Scores

CVSS v3 9.8

EPSS 0.0049

EPSS Percentile 39.5%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CISA SSVC

Vulnrichment

Exploitation poc

Automatable yes

Technical Impact total

Details

CWE

CWE-862

Status published

Published Oct 24, 2024

Tracked Since Feb 18, 2026