CVE-2024-54012: CWE-78 Improper neutralization of special elements used in an OS command ('OS command injection') in Hanwha Vision QND-8080R
CVE-2024-54012 is a high-severity OS command injection vulnerability in the Hanwha Vision QND-8080R camera. The device fails to properly validate input, allowing specially crafted requests to execute malicious OS commands. The vulnerability was discovered by penetration testers at Amazon. The manufacturer has released patch firmware to address this issue. No known exploits are reported in the wild at this time.
AI Analysis
Technical Summary
This vulnerability (CVE-2024-54012) involves improper neutralization of special elements used in OS commands (CWE-78) in the Hanwha Vision QND-8080R camera. Due to insufficient input validation, an attacker with high privileges could send crafted requests that execute arbitrary OS commands on the device. The CVSS 4.0 base score is 8.5, reflecting high impact and moderate attack complexity requiring adjacent network access and high privileges. The vendor has released patch firmware, though no direct patch links or detailed remediation levels are provided in the available data.
Potential Impact
Successful exploitation could allow an attacker with high privileges and adjacent network access to execute arbitrary OS commands on the affected camera, potentially compromising device integrity and confidentiality. The vulnerability does not require user interaction but does require high privileges, limiting remote exploitation scope. No known active exploits have been reported.
Mitigation Recommendations
The manufacturer has released patch firmware to remediate this vulnerability. Users of the Hanwha Vision QND-8080R should apply the latest firmware updates as provided by the vendor. Patch status is not explicitly confirmed in the provided data; therefore, users should consult the official vendor advisory for the most current remediation guidance and firmware availability.
CVE-2024-54012: CWE-78 Improper neutralization of special elements used in an OS command ('OS command injection') in Hanwha Vision QND-8080R
Description
CVE-2024-54012 is a high-severity OS command injection vulnerability in the Hanwha Vision QND-8080R camera. The device fails to properly validate input, allowing specially crafted requests to execute malicious OS commands. The vulnerability was discovered by penetration testers at Amazon. The manufacturer has released patch firmware to address this issue. No known exploits are reported in the wild at this time.
CVSS v4.0
Score 8.5high
Affected software
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
This vulnerability (CVE-2024-54012) involves improper neutralization of special elements used in OS commands (CWE-78) in the Hanwha Vision QND-8080R camera. Due to insufficient input validation, an attacker with high privileges could send crafted requests that execute arbitrary OS commands on the device. The CVSS 4.0 base score is 8.5, reflecting high impact and moderate attack complexity requiring adjacent network access and high privileges. The vendor has released patch firmware, though no direct patch links or detailed remediation levels are provided in the available data.
Potential Impact
Successful exploitation could allow an attacker with high privileges and adjacent network access to execute arbitrary OS commands on the affected camera, potentially compromising device integrity and confidentiality. The vulnerability does not require user interaction but does require high privileges, limiting remote exploitation scope. No known active exploits have been reported.
Mitigation Recommendations
The manufacturer has released patch firmware to remediate this vulnerability. Users of the Hanwha Vision QND-8080R should apply the latest firmware updates as provided by the vendor. Patch status is not explicitly confirmed in the provided data; therefore, users should consult the official vendor advisory for the most current remediation guidance and firmware availability.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- Hanwha_Vision
- Date Reserved
- 2024-11-27T00:56:05.852Z
- Cvss Version
- 4.0
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 69f0602fcbff5d8610cfd2b5
Added to database: 4/28/2026, 7:22:23 AM
Last enriched: 5/5/2026, 7:37:49 AM
Last updated: 6/13/2026, 12:06:46 PM
Views: 46
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.