Medium · 6.7 CVE-2024-52548 EUVD-2024-46145GHSA-fp87-jfrm-4f3f

Lorex 2K Indoor Wi-Fi Security Camera - Code signing bypass

Published Dec 3, 2024 · Updated Dec 3, 2024 · Assigned by rapid7

Vendor: Lorex Product: 2K Indoor Wi-Fi Security Camera

Description

An attacker who can execute arbitrary Operating Systems commands, can bypass code signing enforcements in the kernel, and execute arbitrary native code. This vulnerability has been resolved in firmware version 2.800.0000000.8.R.20241111.

Affected products

Vendor	Product	Affected	Fixed
Lorex	2K Indoor Wi-Fi Security Camera	< 2.800.0000000.8.R.20241111	2.800.0000000.8.R.20241111

References

https://github.com/sfewer-r7/LorexExploit exploit
https://www.rapid7.com/blog/post/2024/12/03/lorex-2k-indoor-wi-fi-security-camera-multiple-vulnerabilities-fixed/ third-party-advisory