Medium · 6.5 CVE-2024-52545 EUVD-2024-46142GHSA-g998-4r58-rr8q

Lorex 2K Indoor Wi-Fi Security Camera - Out of bounds heap read

Published Dec 3, 2024 · Updated Dec 3, 2024 · Assigned by rapid7

Vendor: Lorex Product: 2K Indoor Wi-Fi Security Camera

Description

An unauthenticated attacker can perform an out of bounds heap read in the IQ Service (TCP port 9876). This vulnerability has been resolved in firmware version 2.800.0000000.8.R.20241111.

Affected products

Vendor	Product	Affected	Fixed
Lorex	2K Indoor Wi-Fi Security Camera	< 2.800.0000000.8.R.20241111	2.800.0000000.8.R.20241111

References

https://github.com/sfewer-r7/LorexExploit exploit
https://www.rapid7.com/blog/post/2024/12/03/lorex-2k-indoor-wi-fi-security-camera-multiple-vulnerabilities-fixed/ third-party-advisory