CVEvulnerability
CVE-2024-45173
8.8 HIGH
Official page ↗
- Status
- Analyzed
- Published
- 2024-09-05
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.1 (134c704f-9b21-4f2e-91b3-4a467353bcc0)
- 8.8 HIGH — CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- Weaknesses
- CWE-269
Description
An issue was discovered in za-internet C-MOR Video Surveillance 5.2401. Due to improper privilege management concerning sudo privileges, C-MOR is vulnerable to a privilege escalation attack. The Linux user www-data running the C-MOR web interface can execute some OS commands as root via Sudo without having to enter the root password. These commands, for example, include cp, chown, and chmod, which enable an attacker to modify the system's sudoers file in order to execute all commands with root privileges. Thus, it is possible to escalate the limited privileges of the user www-data to root privileges.
Affected configurations
• c-mor c-mor video surveillance 5.2401
• c-mor c-mor video surveillance 6.00
Related
Weakness · CWE (1)
- CWE-269 Improper Privilege Management weakness
References
- https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2024-027.txt Exploit, Vendor Advisory
- https://www.syss.de/pentest-blog/mehrere-sicherheitsschwachstellen-in-videoueberwachungssoftware-c-mor-syss-2024-020-bis-030 Vendor Advisory
- http://seclists.org/fulldisclosure/2024/Sep/20 Exploit, Mailing List, Third Party Advisory