Lucene search

HiddenLayerCVE-2024-37066

HistoryJul 19, 2024 - 12:15 p.m.

CVE-2024-37066

2024-07-1912:15:02

CWE-78

HiddenLayer

web.nvd.nist.gov

wyze v4 pro

command injection

firmware vulnerability

bluetooth

root access

CVSS3

8.8

Attack Vector

ADJACENT

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

8.3

Confidence

High

EPSS

0.001

Percentile

24.0%

JSON

A command injection vulnerability exists in Wyze V4 Pro firmware versions before 4.50.4.9222, which allows attackers to execute arbitrary commands over Bluetooth as root during the camera setup process.

Affected configurations

Nvd

Node

wyzecam_v4_firmwareRange≤4.52.4.9887

AND

wyzecam_v4

VendorProductVersionCPE
wyzecam_v4_firmware*cpe:2.3:o:wyze:cam_v4_firmware:*:*:*:*:*:*:*:*
wyzecam_v4*cpe:2.3:h:wyze:cam_v4:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
wyze	cam_v4_firmware	*	cpe:2.3:o:wyze:cam_v4_firmware::::::::
wyze	cam_v4	*	cpe:2.3:h:wyze:cam_v4::::::::

CNA Affected

[
  {
    "defaultStatus": "unaffected",
    "product": "Wyze Cam V4 Pro",
    "vendor": "Wyze",
    "versions": [
      {
        "lessThanOrEqual": "4.52.4.9887",
        "status": "affected",
        "version": "0",
        "versionType": "semver"
      }
    ]
  }
]

References

forums.wyze.com/t/security-advisory/289256

hiddenlayer.com/sai-security-advisory/2024-7-wyze/

CVSS3

8.8

Attack Vector

ADJACENT

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

8.3

Confidence

High

EPSS

0.001

Percentile

24.0%

JSON

Related for CVE-2024-37066