CVE-2024-13893
March 6, 2025, 2:15 p.m.
None
No Score
Description
Smartwares cameras CIP-37210AT and C724IP, as well as others which share the same firmware in versions up to 3.3.0, might share same credentials for telnet service. Hash of the password can be retrieved through physical access to SPI connected memory.
For the telnet service to be enabled, the inserted SD card needs to have a folder with a specific name created.
Two products were tested, but since the vendor has not replied to reports, patching status remains unknown, as well as groups of devices and firmware ranges in which the same password is shared.
Newer firmware versions might be vulnerable as well.
Product(s) Impacted
| Product | Versions |
|---|---|
| Smartwares cameras CIP-37210AT |
|
| Smartwares cameras C724IP |
|
Weaknesses
Common security weaknesses mapped to this vulnerability.
CWE-1392
Use of Default Credentials
The product uses default credentials (such as passwords or cryptographic keys) for potentially critical functionality.
Tags
Timeline
Published: March 6, 2025, 2:15 p.m.
Last Modified: March 6, 2025, 2:15 p.m.
Last Modified: March 6, 2025, 2:15 p.m.
Status : Awaiting Analysis
CVE has been recently published to the CVE List and has been received by the NVD.
More infoSource
cvd@cert.pl
*Disclaimer: Some vulnerabilities do not have an associated CPE. To enhance the data, we use AI to infer CPEs based on CVE details. This is an automated process and might not always be accurate.