This vulnerability affects the Nous W3 Smart WiFi Camera firmware update process in version 1.33.50.82. An attacker who can physically access the device and insert a FAT32-formatted SD card containing a maliciously crafted update.tar archive can escalate privileges to root without authentication. This is due to improper validation or handling of the update archive during the firmware update mechanism. The CVSS vector indicates the attack requires physical access (AV:P), has low attack complexity (AC:L), requires no privileges (PR:N) or user interaction (UI:N), and impacts confidentiality, integrity, and availability with high severity.

Successful exploitation results in root privilege escalation on the device, allowing full control over the camera. This compromises the confidentiality, integrity, and availability of the device and potentially the network it is connected to. The attacker must be physically proximate to the device and able to insert a crafted SD card, limiting remote exploitation.

No official patch or fix is currently available for this vulnerability. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is released, restrict physical access to the device to trusted personnel only and avoid using untrusted SD cards for firmware updates.