Read the docs
TI-2024-30276 Aliases CVE-2024-45179GHSA-2v34-3hgh-5vvx

An issue was discovered in za-internet C-MOR Video Surveillance 5.2401 and 6.00PL01.

Priority HIGH 65CWE-1289Published · Updated

Key facts

Attack vector
Network
Privileges required
High
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
High · High · High
Fix status
No fix listed

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA.

Summary

An issue was discovered in za-internet C-MOR Video Surveillance 5.2401 and 6.00PL01. Due to insufficient input validation, the C-MOR web interface is vulnerable to OS command injection attacks. It was found out that different functionality is vulnerable to OS command injection attacks, for example for generating new X.509 certificates, or setting the time zone. These OS command injection vulnerabilities in the script generatesslreq.pml can be exploited as a low-privileged authenticated user to execute commands in the context of the Linux user www-data via shell metacharacters in HTTP POST data (e.g., the city parameter). The OS command injection vulnerability in the script settimezone.pml or setdatetime.pml (e.g., via the year parameter) requires an administrative user for the C-MOR web interface. By also exploiting a privilege-escalation vulnerability, it is possible to execute commands on the C-MOR system with root privileges.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.02595 85th percentileScored 2026-11-07
Public exploit Yes 2 exploit referencesTagged by NVD
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
  • — Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 2

CPEVersionsRoleVendor
cpe:2.3:a:c-mor:c-mor_video_surveillance:5.2401:*:*:*:*:*:*:*5.2401VulnerableC-mor
cpe:2.3:a:c-mor:c-mor_video_surveillance:6.00:patch_level_01:*:*:*:*:*:*6.00 patch_level_01VulnerableC-mor
  • cpe:2.3:a:c-mor:c-mor_video_surveillance:5.2401:*:*:*:*:*:*:* Versions 5.2401 Vulnerable ·C-mor
  • cpe:2.3:a:c-mor:c-mor_video_surveillance:6.00:patch_level_01:*:*:*:*:*:* Versions 6.00 patch_level_01 Vulnerable ·C-mor

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2024-45179
  2. 2026-10-03 Alias added: GHSA-2v34-3hgh-5vvx

References

Exploit 2

  • TI-2024-30271 An issue was discovered in za-internet C-MOR Video Surveillance 5.2401 and 6.00PL01. CVSS 3.1HIGH 8.1
  • TI-2024-30267 An issue was discovered in za-internet C-MOR Video Surveillance 5.2401. CVSS 3.1HIGH 8.1
  • TI-2024-30269 An issue was discovered in za-internet C-MOR Video Surveillance 5.2401 and 6.00PL01. CVSS 3.1MEDIUM 6.8
  • TI-2024-30275 An issue was discovered in za-internet C-MOR Video Surveillance 5.2401. CVSS 3.1HIGH 7.1
  • TI-2024-30274 An issue was discovered in za-internet C-MOR Video Surveillance 5.2401 and 6.00PL01. CVSS 3.1MEDIUM 5.4
  • TI-2024-30270 An issue was discovered in za-internet C-MOR Video Surveillance 5.2401. CVSS 3.1HIGH 8.8
See all 9 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences