CVE-2024-58336
Akuvox Smart Intercom S539 contains an unauthenticated vulnerability that allows remote attackers to access live video streams by requesting the video.cgi endpoint on port 8080.
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (0.40%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
Akuvox Smart Intercom S539 contains an unauthenticated vulnerability that allows remote attackers to access live video streams by requesting the video.cgi endpoint on port 8080. Attackers can retrieve video stream data without authentication by directly accessing the specified endpoint on affected Akuvox doorphone and intercom devices.
- CVSS 4.0
- 8.7 HIGHCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/M
- EPSS
- 0.40% probability · 33th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-306
- Affected
- akuvox/s539 firmware · akuvox/s532 firmware · akuvox/x916 firmware · akuvox/x915 firmware · akuvox/x912 firmware · akuvox/r29 firmware · akuvox/r20k-2 firmware · akuvox/r20a-2 firmware · akuvox/c313w-2 firmware · akuvox/ns-2 firmware · akuvox/nc-2 firmware · akuvox/nx-2 firmware
- Source
- disclosure@vulncheck.com
References
- https://packetstormsecurity.com/files/180262/Broken Link
- https://www.vulncheck.com/advisories/akuvox-smart-intercom-s-unauthenticated-video-stream-disclosureThird Party Advisory
- https://www.zeroscience.mk/en/vulnerabilities/ZSL-2024-5826.phpThird Party Advisory
- https://www.zeroscience.mk/en/vulnerabilities/ZSL-2024-5826.phpThird Party Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.