CVE-2024-12984
📋 TL;DR
This vulnerability in Amcrest IP cameras allows remote attackers to access sensitive information through the web interface. It affects multiple Amcrest camera models up to December 11, 2024. The information disclosure could expose camera configuration details or other sensitive data.
💻 Affected Systems
- Amcrest IP2M-841B
- Amcrest IP2M-841W
- Amcrest IPC-IP2M-841B
- Amcrest IPC-IP3M-943B
- Amcrest IPC-IP3M-943S
- Amcrest IPC-IP3M-HX2B
- Amcrest IPC-IPM-721S
⚠️ Manual Verification Required
This CVE does not have specific version information in our database, so automatic vulnerability detection cannot determine if your system is affected.
Why? The CVE database entry doesn't specify which versions are vulnerable (no version ranges provided by the vendor/NVD).
🔒 Custom verification scripts are available for registered users. Sign up free to download automated test scripts.
- Review the CVE details at NVD
- Check vendor security advisories for your specific version
- Test if the vulnerability is exploitable in your environment
- Consider updating to the latest version as a precaution
⚠️ Risk & Real-World Impact
Worst Case
Attackers obtain camera credentials, network configuration, or other sensitive information that could lead to further compromise of the camera or network.
Likely Case
Unauthorized access to camera configuration files containing device information, network settings, or other operational data.
If Mitigated
Limited exposure of non-critical configuration information with no access to credentials or sensitive data.
🎯 Exploit Status
Exploit details have been publicly disclosed and require only HTTP access to the camera's web interface.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: None available
Restart Required: No
Instructions:
No official patch available. Monitor Amcrest website for firmware updates addressing CVE-2024-12984.
🔧 Temporary Workarounds
Network Segmentation
allRestrict camera network access to prevent unauthorized access to web interface
Access Control Lists
linuxImplement firewall rules to block external access to camera web interface
iptables -A INPUT -p tcp --dport 80 -s trusted_network -j ACCEPT
iptables -A INPUT -p tcp --dport 80 -j DROP
🧯 If You Can't Patch
- Isolate cameras on separate VLAN with strict access controls
- Disable remote web interface access and use VPN for management
🔍 How to Verify
Check if Vulnerable:
Attempt to access http://[camera_ip]/web_caps/webCapsConfig and check if sensitive information is returnedCheck Version:
Check camera firmware version in web interface under Setup > System > System InformationVerify Fix Applied:
Test the same endpoint after applying controls to ensure no sensitive information is disclosed📡 Detection & Monitoring
Log Indicators:
- HTTP requests to /web_caps/webCapsConfig endpoint
- Unusual access patterns to camera web interface
Network Indicators:
- HTTP GET requests to /web_caps/webCapsConfig from unauthorized sources
SIEM Query:
source="camera_logs" AND url="/web_caps/webCapsConfig"