CVE-2024-6248 is an Improper Authentication vulnerability affecting Wyze Cam v3 IP cameras and their firmware. It allows network-adjacent attackers to execute arbitrary code on affected devices without authentication, leveraging the device's MAC address as the sole credential within the run_action_batch endpoint. Rated 7.5 HIGH, this vulnerability has an adjacent attack vector and high impact on confidentiality, integrity, and availability. While no public exploit code or active exploitation has been observed, and community discussion is minimal, the potential for root-level arbitrary code execution makes it a significant concern.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
< 4.36.11.8391CPE matchmatch criteria | cpe:2.3:o:wyze:cam_v3_firmware:*:*:*:*:*:*:*:* |
CVSS version used by this source: 3.0
CVSS:3.0/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.2 Bluesky, 0.1 Mastodon, and 0.1 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.2 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
Remediation records are not available for this CVE.