CVE-2024-13892 - CVE House
Back to Database
Status published High CVE-2024-13892

Command Injection in Smartwares cameras

Vulnerability Description

Smartwares cameras CIP-37210AT and C724IP, as well as others which share the same firmware in versions up to 3.3.0, are vulnerable to command injection. During the initialization process, a user has to use a mobile app to provide devices with Access Point credentials. This input is not properly sanitized, what allows for command injection. The vendor has not replied to reports, so the patching status remains unknown. Newer firmware versions might be vulnerable as well.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2024-13892

Credits & Attribution

The following person or organization is credited with identifying this vulnerability, as recorded in the NVD database:

  • Michał Majchrowicz (Afine Team)
  • Marcin Wyczechowski (Afine Team)

References

More from Smartwares

View All →
CVE-2024-13894
Path traversal in Smartwares cameras
Medium 5.9
CVE-2024-13893
Shared credentials in Smartwares cameras
High 7.5
CVE-2019-25235
Smartwares HOME easy 1.0.9 Client-Side Authentication Bypass via Web Pages
High 8.8

Affected Vendor

Affected Software

CIP-37210AT, C724IP
Vulnerable Versions:
0

Timeline

Official Publish: March 6th, 2025
Last Modified: October 3rd, 2025
Added to House: July 22nd, 2026

CVSS Vectors

Weaknesses (CWE)

CWE-78

MITRE ATT&CK TTPs

T1190 Exploit Public-Facing Application
Initial Access
T1059 Command and Scripting Interpreter
Execution
T1068 Exploitation for Privilege Escalation
Privilege Escalation
T1005 Data from Local System
Collection
T1041 Exfiltration Over C2 Channel
Exfiltration