CVE-2024-52548

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2024-52548", "assignerOrgId": "9974b330-7714-4307-a722-5648477acda7", "state": "PUBLISHED", "assignerShortName": "rapid7", "dateReserved": "2024-11-12T13:42:42.324Z", "datePublished": "2024-12-03T17:29:59.241Z", "dateUpdated": "2024-12-03T21:04:00.985Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "2K Indoor Wi-Fi Security Camera", "vendor": "Lorex", "versions": [{"lessThan": "2.800.0000000.8.R.20241111", "status": "affected", "version": "0", "versionType": "custom"}]}], "datePublic": "2024-12-03T17:27:00.000Z", "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "An attacker who can execute arbitrary Operating Systems commands, can bypass code signing enforcements in the kernel, and execute arbitrary native code. This vulnerability has been resolved in firmware version 2.800.0000000.8.R.20241111.<br>"}], "value": "An attacker who can execute arbitrary Operating Systems commands, can bypass code signing enforcements in the kernel, and execute arbitrary native code. This vulnerability has been resolved in firmware version 2.800.0000000.8.R.20241111."}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 6.7, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-345", "description": "CWE-345 Insufficient Verification of Data Authenticity", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "9974b330-7714-4307-a722-5648477acda7", "shortName": "rapid7", "dateUpdated": "2024-12-03T21:04:00.985Z"}, "references": [{"tags": ["exploit"], "url": "https://github.com/sfewer-r7/LorexExploit"}, {"tags": ["third-party-advisory"], "url": "https://www.rapid7.com/blog/post/2024/12/03/lorex-2k-indoor-wi-fi-security-camera-multiple-vulnerabilities-fixed/"}], "source": {"discovery": "UNKNOWN"}, "title": "Lorex 2K Indoor Wi-Fi Security Camera - Code signing bypass", "x_generator": {"engine": "Vulnogram 0.2.0"}}, "adp": [{"affected": [{"vendor": "lorextechnology", "product": "w461asc-e_firmware", "cpes": ["cpe:2.3:o:lorextechnology:w461asc-e_firmware:-:*:*:*:*:*:*:*"], "defaultStatus": "unknown", "versions": [{"version": "0", "status": "affected", "lessThan": "2.800.0000000.8.r.20241111", "versionType": "custom"}]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2024-12-03T18:28:51.593704Z", "id": "CVE-2024-52548", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-12-03T18:37:54.197Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-52548", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2024-12-03T18:28:51.593704Z"}}}], "affected": [{"cpes": ["cpe:2.3:o:lorextechnology:w461asc-e_firmware:-:*:*:*:*:*:*:*"], "vendor": "lorextechnology", "product": "w461asc-e_firmware", "versions": [{"status": "affected", "version": "0", "lessThan": "2.800.0000000.8.r.20241111", "versionType": "custom"}], "defaultStatus": "unknown"}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-12-03T18:37:50.260Z"}}], "cna": {"title": "Lorex 2K Indoor Wi-Fi Security Camera - Code signing bypass", "source": {"discovery": "UNKNOWN"}, "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.7, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "Lorex", "product": "2K Indoor Wi-Fi Security Camera", "versions": [{"status": "affected", "version": "0", "lessThan": "2.800.0000000.8.R.20241111", "versionType": "custom"}], "defaultStatus": "unaffected"}], "datePublic": "2024-12-03T17:27:00.000Z", "references": [{"url": "https://github.com/sfewer-r7/LorexExploit", "tags": ["exploit"]}, {"url": "https://www.rapid7.com/blog/post/2024/12/03/lorex-2k-indoor-wi-fi-security-camera-multiple-vulnerabilities-fixed/", "tags": ["third-party-advisory"]}], "x_generator": {"engine": "Vulnogram 0.2.0"}, "descriptions": [{"lang": "en", "value": "An attacker who can execute arbitrary Operating Systems commands, can bypass code signing enforcements in the kernel, and execute arbitrary native code. This vulnerability has been resolved in firmware version 2.800.0000000.8.R.20241111.", "supportingMedia": [{"type": "text/html", "value": "An attacker who can execute arbitrary Operating Systems commands, can bypass code signing enforcements in the kernel, and execute arbitrary native code. This vulnerability has been resolved in firmware version 2.800.0000000.8.R.20241111.<br>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-345", "description": "CWE-345 Insufficient Verification of Data Authenticity"}]}], "providerMetadata": {"orgId": "9974b330-7714-4307-a722-5648477acda7", "shortName": "rapid7", "dateUpdated": "2024-12-03T21:04:00.985Z"}}}, "cveMetadata": {"cveId": "CVE-2024-52548", "state": "PUBLISHED", "dateUpdated": "2024-12-03T21:04:00.985Z", "dateReserved": "2024-11-12T13:42:42.324Z", "assignerOrgId": "9974b330-7714-4307-a722-5648477acda7", "datePublished": "2024-12-03T17:29:59.241Z", "assignerShortName": "rapid7"}, "dataVersion": "5.1"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "2K Indoor Wi-Fi Security Camera", "vendor": "Lorex", "versions": [{"lessThan": "2.800.0000000.8.R.20241111", "status": "affected", "version": "0", "versionType": "custom"}]}], "source": "cve@rapid7.com"}, {"affectedData": [{"cpes": ["cpe:2.3:o:lorextechnology:w461asc-e_firmware:-:*:*:*:*:*:*:*"], "defaultStatus": "unknown", "product": "w461asc-e_firmware", "vendor": "lorextechnology", "versions": [{"lessThan": "2.800.0000000.8.r.20241111", "status": "affected", "version": "0", "versionType": "custom"}]}], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "An attacker who can execute arbitrary Operating Systems commands, can bypass code signing enforcements in the kernel, and execute arbitrary native code. This vulnerability has been resolved in firmware version 2.800.0000000.8.R.20241111."}, {"lang": "es", "value": " Un atacante que puede ejecutar comandos arbitrarios de sistemas operativos, puede eludir las exigencias de firma de c\u00f3digo en el n\u00facleo y ejecutar c\u00f3digo nativo arbitrario. Esta vulnerabilidad se ha resuelto en la versi\u00f3n de firmware 2.800.0000000.8.R.20241111."}], "id": "CVE-2024-52548", "lastModified": "2026-06-17T08:07:26.067", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 6.7, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 0.8, "impactScore": 5.9, "source": "cve@rapid7.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2024-52548", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2024-12-03T18:28:51.593704Z", "version": "2.0.3"}}]}, "published": "2024-12-03T18:15:16.023", "references": [{"source": "cve@rapid7.com", "url": "https://github.com/sfewer-r7/LorexExploit"}, {"source": "cve@rapid7.com", "url": "https://www.rapid7.com/blog/post/2024/12/03/lorex-2k-indoor-wi-fi-security-camera-multiple-vulnerabilities-fixed/"}], "sourceIdentifier": "cve@rapid7.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-345"}], "source": "cve@rapid7.com", "type": "Secondary"}]}

{}

{}