CVE-2024-25458: Information Exposure
Source CVE Database V5
Not known to be exploited · CVSS 7.5 High.
Data as of 26 Oct 2026, 17:16 UTC
- EPSS
- 0.5% chance of exploitation in 30 days – higher than 47% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:NExploitation evidence
Disclosed: evidence found.
CVE published 1 May 2024
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors
A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 26 Oct 2026.
What to do
AI-suggested
Given the lack of an official patch, organizations should implement network-level controls to mitigate exploitation risks. First, restrict UDP traffic to and from the affected cameras by implementing firewall rules that limit access to trusted management networks or specific IP addresses. Employ network segmentation to isolate these devices from the broader enterprise network and the internet, reducing exposure to external attackers. Monitor network traffic for unusual or unexpected UDP requests targeting the cameras' ports, using intrusion detection or prevention systems to alert on potential exploitation attempts. If possible, disable unused UDP services or ports on the devices to minimize the attack surface. Engage with the vendor for firmware updates or advisories and plan for prompt patch deployment once available. Additionally, consider deploying compensating controls such as VPN access for remote management and enhanced logging to detect suspicious activity. Regularly audit device configurations and credentials to ensure they follow security best practices.
Description
An issue in CYCZCAM, SHIX ZHAO, SHIXCAM A9 Camera (circuit board identifier A9-48B-V1.0) firmware v.CYCAM_48B_BC01_v87_0903 allows a remote attacker to obtain sensitive information via a crafted request to a UDP port.