CVE-2021-33549

UDP Technology/Geutebrück camera devices: Buffer overflow in action parameter leading to RCE

Multiple camera devices by UDP Technology, Geutebrück and other vendors are vulnerable to a stack-based buffer overflow condition in the action parameter, which may allow an attacker to remotely execute arbitrary code.

Affected

Geutebrück · E2 Series · Encoder G-Code

CVSS v3.1 NVD

7.2 HIGHCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

CVSS v2.0 NVD

6.5 MEDIUMAV:N/AC:L/Au:S/C:P/I:P/A:P

EPSS

67.31% chance of exploitation in the next 30 days, 99th percentile

Published

2021-09-13

Updated

2024-09-17

Proof-of-concept exploits (1)

• http://packetstormsecurity.com/files/164191/Geutebruck-instantrec-Remote-Command-Executio…

Metasploit modules (1)

• rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/geutebruck_instantrec…

Security advisories

• https://us-cert.cisa.gov/ics/advisories/icsa-21-208-03
• https://www.randorisec.fr/fr/udp-technology-ip-camera-vulnerabilities

References

• CVE Record
• NVD entry