CVE-2024-37066 Vulnerability Details

  /     /     /  

CVE-2024-37066 Metadata Quick Info

CVE Published: 19/07/2024 | CVE Updated: 02/08/2024 | CVE Year: 2024
Source: HiddenLayer | Vendor: Wyze | Product: Wyze Cam V4 Pro
Status : PUBLISHED

---

CVE-2024-37066 Description

A command injection vulnerability exists in Wyze V4 Pro firmware versions before 4.50.4.9222, which allows attackers to execute arbitrary commands over Bluetooth as root during the camera setup process.

Metrics

CVSS Version: 3.1 | Base Score: 6.8 MEDIUM
Vector: CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

l➤ Exploitability Metrics:
    Attack Vector (AV)* PHYSICAL
    Attack Complexity (AC)* LOW
    Privileges Required (PR)* NONE
    User Interaction (UI)* NONE
    Scope (S)* UNCHANGED

l➤ Impact Metrics:
    Confidentiality Impact (C)* HIGH
    Integrity Impact (I)* HIGH
    Availability Impact (A)* HIGH

Weakness Enumeration (CWE)

CWE-ID: CWE-78
CWE Name: CWE-78 Improper Neutralization of Special Elements used in an OS Command ( OS Command Injection )
Source: Wyze

Common Attack Pattern Enumeration and Classification (CAPEC)

CAPEC-ID: CAPEC-88
CAPEC Description: CAPEC-88 OS Command Injection


Source: NVD (National Vulnerability Database).