CVE-2024-45178: za-internet C-MOR Video Surveillance · Path Traversal
Source CVE Database V5
Not known to be exploited · CVSS 7.1 High.
Data as of 26 Oct 2026, 17:16 UTC
- EPSS
- 1.2% chance of exploitation in 30 days – higher than 69% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:NExploitation evidence
Disclosed: evidence found.
CVE published 5 Sep 2024
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors
A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 26 Oct 2026.
What to do
AI-suggested
To mitigate CVE-2024-45178, organizations should first check for official patches or updates from za-internet and apply them promptly once available. In the absence of patches, implement strict access controls to limit authenticated user privileges, ensuring only trusted personnel have access to the surveillance system. Employ network segmentation to isolate the C-MOR system from broader enterprise networks, reducing exposure. Monitor and audit user activities on the system to detect unusual file access patterns indicative of exploitation attempts. Consider deploying web application firewalls (WAFs) with custom rules to detect and block path traversal payloads targeting vulnerable parameters like 'bkf' and 'cam'. Additionally, review and harden the web server configuration to restrict file system access and disable unnecessary functionalities. Regularly back up critical data and maintain incident response plans to quickly address potential breaches. Finally, educate users about the importance of strong authentication and monitoring to prevent credential compromise.
Description
An issue was discovered in za-internet C-MOR Video Surveillance 5.2401. Due to improper user input validation, it is possible to download arbitrary files from the C-MOR system via a path traversal attack. It was found out that different functionalities are vulnerable to path traversal attacks, due to insufficient user input validation. For instance, the download functionality for backups provided by the script download-bkf.pml is vulnerable to a path traversal attack via the parameter bkf. This enables an authenticated user to download arbitrary files as Linux user www-data from the C-MOR system. Another path traversal attack is in the script show-movies.pml, which can be exploited via the parameter cam.