CVE-2024-54847: CP Plus CP-VNR-3104 Information Disclosure

CVE-2024-54847 Overview

CVE-2024-54847 affects the CP Plus CP-VNR-3104 network video recorder (NVR) running firmware version B3223P22C02424. The device exposes weak Diffie-Hellman (DH) parameters, allowing network-based attackers to recover key material or intercept encrypted communications. Successful exploitation enables access to sensitive data or a man-in-the-middle (MITM) attack against sessions protected by the affected key exchange. The issue is categorized under [CWE-295] Improper Certificate Validation and stems from cryptographic weaknesses in the device's TLS implementation. This vulnerability primarily impacts confidentiality of video surveillance streams and management traffic handled by the NVR.

Critical Impact
Attackers on the network path can decrypt or intercept CP-VNR-3104 traffic through weak DH parameters, exposing surveillance data and credentials.

Affected Products

CP Plus CP-VNR-3104 (hardware)
CP Plus CP-VNR-3104 firmware version B3223P22C02424
Cpplusworld NVR product line using the same cryptographic module

Discovery Timeline

2025-01-10 - CVE-2024-54847 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-54847

Vulnerability Analysis

The CP-VNR-3104 NVR negotiates TLS sessions using Diffie-Hellman parameters that are exposed or insufficiently strong. An attacker positioned on the network can retrieve these parameters and either derive session keys or coerce clients into a compromised key exchange. This allows passive decryption of previously captured traffic or active interception of live sessions. The weakness aligns with historic issues such as the CVE-2023-3817 advisory, where oversized or malformed DH parameters permit cryptographic downgrade. Because the NVR handles camera streams, credentials, and configuration data, compromised sessions can leak surveillance footage and administrative secrets. The attack requires network access to the device but no authentication or user interaction.

Root Cause

The root cause is improper handling of Diffie-Hellman parameters within the device's TLS stack. The firmware either uses static, short, or predictable DH parameters, or fails to validate parameters supplied during key exchange. This weakens the forward secrecy properties expected from ephemeral DH and enables key recovery within a practical computational bound.

Attack Vector

An attacker on the same network segment or upstream path initiates or intercepts a TLS handshake with the NVR. By observing the DH parameters and public values, the attacker recovers the shared secret and decrypts session traffic. In active MITM scenarios, the attacker relays and modifies traffic between client and NVR while presenting the compromised parameters. The attack complexity is high because it requires cryptographic computation and network positioning, but no credentials are needed. For further technical background on firmware-level cryptographic weaknesses, see the CP-VNR-3104 Security Assessment and the Payatu blog on encrypted firmware.

Detection Methods for CVE-2024-54847

Indicators of Compromise

Unexpected TLS handshakes to the CP-VNR-3104 management interface from unknown source addresses.
TLS sessions negotiated with DH key sizes below 2048 bits or using known weak parameter groups.
ARP or DNS anomalies on network segments hosting the NVR, indicating potential MITM staging.
Duplicate or replayed TLS session identifiers observed against the NVR.

Detection Strategies

Inspect TLS handshakes to the NVR using network security monitoring tools and flag weak DH parameter sets.
Perform authenticated scans of the device to enumerate supported cipher suites and key exchange strengths.
Correlate network flow data with device management logs to identify off-hours or unauthorized administrative sessions.

Monitoring Recommendations

Log all connections to the NVR management interface and alert on new client fingerprints.
Monitor for downgraded TLS negotiations or unexpected cipher suite selections involving DH key exchange.
Deploy passive TLS inspection at network chokepoints to identify weak parameter usage across IoT and surveillance devices.

How to Mitigate CVE-2024-54847

Immediate Actions Required

Isolate the CP-VNR-3104 on a dedicated VLAN with strict access control lists limiting management traffic to trusted hosts.
Disable remote management interfaces exposed to untrusted networks or the internet.
Enforce VPN or IPsec tunnels for all administrative and streaming sessions to the NVR.
Rotate any credentials that may have traversed vulnerable TLS sessions.

Patch Information

At the time of publication, no vendor advisory or firmware patch has been published for CVE-2024-54847. Contact CP Plus support directly to request updated firmware that addresses weak Diffie-Hellman parameters. Monitor the vendor security assessment repository for updates on remediation status.

Workarounds

Restrict network reachability of the NVR to a small set of trusted management workstations.
Terminate NVR traffic behind a reverse proxy that enforces strong TLS 1.2 or 1.3 with 2048-bit or larger DH groups.
Disable legacy cipher suites and key exchange methods on any upstream load balancer or firewall inspecting the traffic.
Continuously monitor the network segment for MITM indicators until a vendor firmware update is available.

bash

# Example: restrict NVR management to a trusted subnet using iptables on an upstream gateway
iptables -A FORWARD -p tcp -d <NVR_IP> --dport 443 -s 10.10.20.0/24 -j ACCEPT
iptables -A FORWARD -p tcp -d <NVR_IP> --dport 443 -j DROP