CVE-2024-58336
📋 TL;DR
Akuvox Smart Intercom S539 devices contain an unauthenticated vulnerability that allows remote attackers to access live video streams without authentication by directly requesting the video.cgi endpoint on port 8080. This affects Akuvox doorphone and intercom devices, potentially exposing private video feeds to unauthorized individuals.
💻 Affected Systems
- Akuvox Smart Intercom S539
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete loss of privacy as attackers can monitor all video feeds from vulnerable devices, potentially capturing sensitive activities, personal information, or security footage.
Likely Case
Unauthorized surveillance of entry points, allowing attackers to monitor who enters/exits premises, potentially enabling social engineering or physical security bypass.
If Mitigated
Limited to internal network access only, reducing exposure to authorized personnel within the network perimeter.
🎯 Exploit Status
Simple HTTP request to video.cgi endpoint on port 8080. No authentication or special tools required.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: Not provided in references
Restart Required: No
Instructions:
Check Akuvox official website for firmware updates. Apply latest firmware if available. If no patch exists, implement workarounds.
🔧 Temporary Workarounds
Network Access Control
linuxRestrict access to port 8080 on affected devices using firewall rules
iptables -A INPUT -p tcp --dport 8080 -j DROP
ufw deny 8080
Network Segmentation
allPlace intercom devices on isolated VLAN separate from sensitive networks
🧯 If You Can't Patch
- Block port 8080 at network perimeter using firewall rules
- Disable remote access features if not required
- Monitor network traffic to port 8080 for unauthorized access attempts
🔍 How to Verify
Check if Vulnerable:
Attempt to access http://[device_ip]:8080/video.cgi from an unauthenticated session. If video stream loads without authentication, device is vulnerable.Check Version:
Check device web interface or console for firmware version informationVerify Fix Applied:
After implementing controls, verify that http://[device_ip]:8080/video.cgi returns authentication error or is inaccessible.📡 Detection & Monitoring
Log Indicators:
- HTTP requests to /video.cgi without authentication
- Multiple failed authentication attempts followed by successful video.cgi access
Network Indicators:
- Unusual traffic to port 8080 from external IPs
- Video stream data being transmitted to unauthorized destinations
SIEM Query:
source_ip=* AND dest_port=8080 AND uri_path="/video.cgi" AND auth_result="failed"