Secuno
ENNL
Book demo

CVE-2024-45179

C-mor Video Surveillance command injection

7.2 HIGHPublic exploitEPSS 2.60%
  1. Published9 Oct 2024

Description

An issue was discovered in za-internet C-MOR Video Surveillance 5.2401 and 6.00PL01. Due to insufficient input validation, the C-MOR web interface is vulnerable to OS command injection attacks. It was found out that different functionality is vulnerable to OS command injection attacks, for example for generating new X.509 certificates, or setting the time zone. These OS command injection vulnerabilities in the script generatesslreq.pml can be exploited as a low-privileged authenticated user to execute commands in the context of the Linux user www-data via shell metacharacters in HTTP POST data (e.g., the city parameter). The OS command injection vulnerability in the script settimezone.pml or setdatetime.pml (e.g., via the year parameter) requires an administrative user for the C-MOR web interface. By also exploiting a privilege-escalation vulnerability, it is possible to execute commands on the C-MOR system with root privileges.

CVSS 3.1 breakdown

Attack vectorNetwork
Attack complexityLow
Privileges requiredHigh
User interactionNone
ScopeUnchanged
ConfidentialityHigh
IntegrityHigh
AvailabilityHigh
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Affected products

C-mor Video Surveillance5.2401 · 6.00

Remediation

No fixed version is recorded in the NVD data. Check the vendor advisory for the latest guidance.

References

Related CVEs

Recent high-severity vulnerabilities sharing a weakness type.

CVE-2026-1002558.1
In JetBrains TeamCity before 2026.2, 2026.1.4, 2025.11.8 administrator account…
CVE-2026-971969.1
Improper Validation of Unsafe Equivalence in Input vulnerability in Liquid Web /…
CVE-2026-868318.7
Improper validation of pod identifier uniqueness in aws-network-policy-agent in Amazon…
CVE-2026-890499.9
A server-side request forgery issue due to improper validation of equivalent address…
CVE-2026-500909.3
The Aqara Cloud OAuth Authorization Endpoint (open-cn.aqara.com/oauth/authorize) is…
CVE-2026-398219.6
The ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that…

Frequently asked

Is CVE-2024-45179 being actively exploited?

CVE-2024-45179 is not in the CISA KEV catalog. A public exploit reference exists, so treat it as exploitable. Its EPSS exploit probability is 2.60%.

How severe is CVE-2024-45179?

CVE-2024-45179 has a CVSS 3.1 base score of 7.2, rated high. EPSS estimates a 2.60% probability of exploitation.

Which products are affected by CVE-2024-45179?

Affected products include C-mor Video Surveillance.

How do I fix CVE-2024-45179?

Apply the vendor's patch or advisory guidance, then verify no affected versions remain across your devices.

How Secuno handles this

Secuno correlates vulnerabilities like CVE-2024-45179 against the real software inventory on every managed device, every day. Rather than a static severity, each match is scored in context: exploit availability, EPSS, the asset's exposure, and business criticality decide where it lands in the queue. If an affected version is present anywhere across your portfolio, it surfaces automatically with a prioritised remediation path.

See how prioritisation worksBook a demo

Get Patch this first every Monday

Five vulnerabilities that matter this week, ranked on real exploitation. Plain language, one email, no spam.

You can unsubscribe with one click from every issue. We handle your details as described in our privacy policy.

Data from the NVD, CISA KEV catalog and FIRST EPSS. CVSS 3.1 base score shown where available.