« Volver al listado

CVE-2024-37066

Estado: ModificadaAlta (8.8)—

A command injection vulnerability exists in Wyze V4 Pro firmware versions before 4.50.4.9222, which allows attackers to execute arbitrary commands over Bluetooth as root during the camera setup process.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Wyze — CAM V4 Firmware

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2024-37066",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2024-37066",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2024-07-19T15:24:53.197036Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "6f8de1f0-f67e-45a6-b68f-98777fdb759c",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 6.8,
          "attackVector": "PHYSICAL",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 0.9
      },
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 8.8,
          "attackVector": "ADJACENT_NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 2.8
      }
    ]
  },
  "affected": [
    {
      "source": "6f8de1f0-f67e-45a6-b68f-98777fdb759c",
      "affectedData": [
        {
          "vendor": "Wyze",
          "product": "Wyze Cam V4 Pro",
          "versions": [
            {
              "status": "affected",
              "version": "0",
              "versionType": "semver",
              "lessThanOrEqual": "4.52.4.9887"
            }
          ],
          "defaultStatus": "unaffected"
        }
      ]
    },
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "affectedData": [
        {
          "cpes": [
            "cpe:2.3:a:wyze:cam_v4_pro:*:*:*:*:*:*:*:*"
          ],
          "vendor": "wyze",
          "product": "cam_v4_pro",
          "versions": [
            {
              "status": "affected",
              "version": "0",
              "versionType": "semver",
              "lessThanOrEqual": "4.52.4.9887"
            }
          ],
          "defaultStatus": "unknown"
        }
      ]
    }
  ],
  "published": "2024-07-19T12:15:02.320",
  "references": [
    {
      "url": "https://forums.wyze.com/t/security-advisory/289256",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "6f8de1f0-f67e-45a6-b68f-98777fdb759c"
    },
    {
      "url": "https://hiddenlayer.com/sai-security-advisory/2024-7-wyze/",
      "tags": [
        "Exploit",
        "Third Party Advisory"
      ],
      "source": "6f8de1f0-f67e-45a6-b68f-98777fdb759c"
    },
    {
      "url": "https://forums.wyze.com/t/security-advisory/289256",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://hiddenlayer.com/sai-security-advisory/2024-7-wyze/",
      "tags": [
        "Exploit",
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "6f8de1f0-f67e-45a6-b68f-98777fdb759c",
      "description": [
        {
          "lang": "en",
          "value": "CWE-78"
        }
      ]
    },
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-78"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "A command injection vulnerability exists in Wyze V4 Pro firmware versions before 4.50.4.9222, which allows attackers to execute arbitrary commands over Bluetooth as root during the camera setup process."
    },
    {
      "lang": "es",
      "value": " Existe una vulnerabilidad de inyección de comandos en las versiones de firmware Wyze V4 Pro anteriores a la 4.50.4.9222, que permite a los atacantes ejecutar comandos arbitrarios a través de Bluetooth como root durante el proceso de configuración de la cámara."
    }
  ],
  "lastModified": "2026-06-17T07:37:42.613",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:wyze:cam_v4_firmware:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "678B080B-FFD7-4303-8812-CAAF44E3CBBC",
              "versionEndIncluding": "4.52.4.9887"
            }
          ],
          "operator": "OR"
        },
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:wyze:cam_v4:*:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "B7966E04-5847-4556-AD80-A9EF9E27E9D7"
            }
          ],
          "operator": "OR"
        }
      ],
      "operator": "AND"
    }
  ],
  "sourceIdentifier": "6f8de1f0-f67e-45a6-b68f-98777fdb759c"
}