CVE-2024-13892

Command Injection in Smartwares cameras

State: Published
Severity: 7.7 High
Published: Mar 6, 2025
Updated: Oct 3, 2025
Reserved: Feb 20, 2025

Description

Smartwares cameras CIP-37210AT and C724IP, as well as others which share the same firmware in versions up to 3.3.0, are vulnerable to command injection. During the initialization process, a user has to use a mobile app to provide devices with Access Point credentials. This input is not properly sanitized, what allows for command injection. The vendor has not replied to reports, so the patching status remains unknown. Newer firmware versions might be vulnerable as well.

Scores

CVSS	Score	Vector	Source
4.0	7.7 High	CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N	CERT-PL

Weaknesses

CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

Affected Products

Product	Versions
CIP-37210ATSmartwares	3.3.0 and earlierAffected
C724IPSmartwares	3.3.0 and earlierAffected

References

https://cert.pl/en/posts/2025/03/CVE-2024-13892/third-party-advisory
https://www.smartwares.eu/en-gb/smartwares-cip-37210at-indoor-wi-fi-camera-cip--37210atproduct

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.