Lucene search

6f8de1f0-f67e-45a6-b68f-98777fdb759cNVD:CVE-2024-37066

HistoryJul 19, 2024 - 12:15 p.m.

CVE-2024-37066

2024-07-1912:15:02

CWE-78

6f8de1f0-f67e-45a6-b68f-98777fdb759c

web.nvd.nist.gov

wyze v4 pro

command injection

firmware vulnerability

bluetooth

camera setup

CVSS3

8.8

Attack Vector

ADJACENT

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS

0.001

Percentile

24.0%

JSON

A command injection vulnerability exists in Wyze V4 Pro firmware versions before 4.50.4.9222, which allows attackers to execute arbitrary commands over Bluetooth as root during the camera setup process.

Affected configurations

Nvd

Node

wyzecam_v4_firmwareRange≤4.52.4.9887

AND

wyzecam_v4

VendorProductVersionCPE
wyzecam_v4_firmware*cpe:2.3:o:wyze:cam_v4_firmware:*:*:*:*:*:*:*:*
wyzecam_v4*cpe:2.3:h:wyze:cam_v4:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
wyze	cam_v4_firmware	*	cpe:2.3:o:wyze:cam_v4_firmware::::::::
wyze	cam_v4	*	cpe:2.3:h:wyze:cam_v4::::::::

References

forums.wyze.com/t/security-advisory/289256

hiddenlayer.com/sai-security-advisory/2024-7-wyze/

CVSS3

8.8

Attack Vector

ADJACENT

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS

0.001

Percentile

24.0%

JSON

Related for NVD:CVE-2024-37066