CVE-2024-7029 is a critical vulnerability in Avtech AVM1203 IP cameras that allows for remote code execution (RCE) without the need for authentication. This vulnerability is particularly dangerous because it can be exploited over the network, enabling attackers to inject and execute commands remotely. The flaw is located in the brightness function of the camera's firmware, specifically in the "action=" parameter, which can be manipulated to execute arbitrary commands with the same privileges as the device owner.
The vulnerability affects firmware versions up to and including FullImg-1023-1007-1011-1009. Despite being a known issue since 2019, Avtech has not released a patch, and the cameras have been discontinued. This leaves the devices permanently vulnerable, posing a significant risk to users. The vulnerability has been actively exploited by various malware, including the Corona Mirai-based botnet, which has been using this flaw to infect and control the cameras for malicious purposes.
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has issued advisories about this vulnerability, highlighting its low attack complexity and the ability to exploit it remotely. The vulnerability is being exploited in the wild, with a public Proof of Concept (PoC) available since at least 2019. The exploitation campaign has been active since early 2024, targeting critical infrastructure sectors such as commercial facilities, healthcare, financial services, and transportation systems.
Given the high CVSS score of 8.8, this vulnerability is considered highly critical. The lack of a patch and the continued use of these cameras in critical infrastructure make it imperative for users to take immediate action to mitigate the risk.
| 