Owlet Camera OS command injection
Priority MEDIUM 45CWE-78Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Code execution
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-78.
Summary
A command injection vulnerability exists in the IOCTL that manages OTA updates. A specially crafted command can lead to command execution as the root user. An attacker can make authenticated requests to trigger this vulnerability.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.02748 86th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed Cam v2 (Owlet): 4.2.10Cam v1 (Owlet): 4.2.11
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Owlet | Cam v2 | before 4.2.10 | 4.2.10 | Patch available | CNA |
| Owlet | Cam v1 | before 4.2.11 | 4.2.11 | Patch available | CNA |
- Cam v2 VendorOwlet Affected before 4.2.10 Fixed in 4.2.10 Patch available CNA
- Cam v1 VendorOwlet Affected before 4.2.11 Fixed in 4.2.11 Patch available CNA
CPE configurations NVD · 5
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:o:owletcare:cam_firmware:*:*:*:*:*:*:*:* | before 4.2.11 | Vulnerable | Owletcare |
| cpe:2.3:h:owletcare:cam:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Owletcare |
| cpe:2.3:o:owletcare:cam_2_firmware:*:*:*:*:*:*:*:* | before 4.2.10 | Vulnerable | Owletcare |
| cpe:2.3:h:owletcare:cam_2:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Owletcare |
| cpe:2.3:a:throughtek:kalay_platform:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | ThroughTek |
- cpe:2.3:o:owletcare:cam_firmware:*:*:*:*:*:*:*:* Versions before 4.2.11 Vulnerable ·Owletcare
- cpe:2.3:h:owletcare:cam:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Owletcare
- cpe:2.3:o:owletcare:cam_2_firmware:*:*:*:*:*:*:*:* Versions before 4.2.10 Vulnerable ·Owletcare
- cpe:2.3:h:owletcare:cam_2:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Owletcare
- cpe:2.3:a:throughtek:kalay_platform:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·ThroughTek
Remediation
- Fix · CNA Cam v2 (Owlet) Fixed in 4.2.10
- Fix · CNA Cam v1 (Owlet) Fixed in 4.2.11
Timeline
- 2026-10-02 Threatist record created from CVE-2023-6321
- 2026-10-03 Alias added: GHSA-7h6w-cw39-chrh
References
Sources
- CVE-2023-6321 · CVE Program
- CVE-2023-6321 · NVD
- FIRST EPSS
- GHSA-7h6w-cw39-chrh · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences