CVE-2024-13892: Smartwares Camera RCE Vulnerability

CVE-2024-13892 Overview

CVE-2024-13892 is a command injection vulnerability affecting Smartwares cameras, including the CIP-37210AT and C724IP models, along with other devices sharing the same firmware in versions up to 3.3.0. During device initialization, the mobile companion app supplies Access Point (AP) credentials to the camera. The firmware fails to sanitize this input, allowing an attacker on the adjacent network to inject arbitrary operating system commands. CERT Poland reports the vendor has not responded to disclosure attempts, and the patch status remains unknown. Newer firmware versions may also be affected.

Critical Impact
An attacker on the adjacent wireless network can execute arbitrary commands on the camera during setup, achieving full compromise of confidentiality, integrity, and availability [CWE-78].

Affected Products

Smartwares CIP-37210AT indoor Wi-Fi camera (firmware ≤ 3.3.0)
Smartwares C724IP camera (firmware ≤ 3.3.0)
Other Smartwares cameras sharing the same firmware base (potentially including newer versions)

Discovery Timeline

2025-03-06 - CVE-2024-13892 published to NVD by CERT Poland
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-13892

Vulnerability Analysis

The flaw resides in the initial provisioning workflow of the Smartwares cameras. When a user first configures the device, the mobile application transmits Wi-Fi Access Point credentials to the camera over an adjacent-network channel. The firmware passes these strings to a system-level shell context without input validation or sanitization. An attacker who can reach the camera during setup, or who can coerce a user through a rogue provisioning flow, can embed shell metacharacters within the SSID or password fields. This is a classic OS Command Injection weakness tracked under [CWE-78].

Successful exploitation yields code execution on the embedded Linux platform of the camera. From that foothold, attackers can pivot into the local network, exfiltrate the video stream, tamper with device firmware, or enroll the device into a botnet. Because the vendor has not acknowledged the report, defenders should assume other product lines sharing the same firmware image are also affected.

Root Cause

The firmware concatenates the user-supplied AP credential strings directly into shell command invocations used to configure the Wi-Fi client. Without allow-list validation, character escaping, or use of exec-style APIs that separate arguments from the command line, shell metacharacters such as ;, |, backticks, and $(...) are interpreted as command delimiters.

Attack Vector

The attacker must be within radio range of the camera during its provisioning state, or must trick a legitimate operator into supplying attacker-controlled credentials. Authentication is not required, and no user interaction is needed on the target device beyond the standard setup flow. The malicious payload is embedded in the AP credential fields transmitted by the mobile app.

No public proof-of-concept code is available. Technical details are documented in the CERT Poland CVE-2024-13892 advisory.

Detection Methods for CVE-2024-13892

Indicators of Compromise

Unexpected outbound connections from camera IP addresses to unknown hosts, especially during or shortly after initial setup
Anomalous DNS queries or HTTP requests originating from IoT camera VLANs
Cameras exhibiting elevated CPU usage, unexpected running processes, or open ports beyond the vendor-documented baseline
Presence of shell metacharacters (;, |, `, $() in captured provisioning traffic

Detection Strategies

Inspect wireless provisioning traffic during device onboarding for injection patterns in SSID and passphrase fields
Baseline network behavior for each camera and alert on deviations such as new listening ports or outbound C2-style beaconing
Segment IoT devices onto dedicated VLANs and monitor east-west traffic for lateral movement attempts

Monitoring Recommendations

Forward network flow logs and DHCP lease data from IoT segments into a SIEM for correlation
Alert on any interactive shell traffic or reverse-shell patterns sourced from camera IP ranges
Track firmware versions across the camera fleet and flag devices running versions ≤ 3.3.0

How to Mitigate CVE-2024-13892

Immediate Actions Required

Inventory all Smartwares cameras and identify those running firmware version 3.3.0 or earlier
Isolate affected cameras on a segregated VLAN with no route to sensitive internal resources
Restrict provisioning to a controlled, RF-shielded environment to prevent adjacent-network attackers from intercepting or manipulating setup traffic
Consider replacing affected devices with vendor-supported alternatives if the vendor remains unresponsive

Patch Information

As of the last NVD update, no vendor patch has been published. CERT Poland notes that Smartwares has not responded to disclosure attempts, so the remediation status is unknown. Newer firmware releases may still contain the same code path. Monitor the Smartwares product page and the CERT Poland advisory for updates.

Workarounds

Deploy cameras only on isolated IoT networks with strict egress filtering and no inbound access from untrusted segments
Block outbound internet access for cameras except to explicitly required vendor cloud endpoints
Disable or physically decommission affected cameras in high-sensitivity environments until a verified patch is released
Use Wi-Fi Protected Access 3 (WPA3) on the provisioning SSID and reduce radio power during setup to shrink the adjacent-network attack surface

bash

# Example firewall rules to isolate IoT cameras (Linux iptables syntax)
# Replace 192.0.2.0/24 with your IoT VLAN CIDR
iptables -A FORWARD -s 192.0.2.0/24 -d 10.0.0.0/8 -j DROP
iptables -A FORWARD -s 192.0.2.0/24 -d 172.16.0.0/12 -j DROP
iptables -A FORWARD -s 192.0.2.0/24 -d 192.168.0.0/16 -j DROP
iptables -A FORWARD -s 192.0.2.0/24 -o eth_wan -j ACCEPT