CVE-2023-30353

Vulnerability

The Shenzen Tenda IP Camera CP3 firmware version V11.10.00.2211041355 contains a command injection vulnerability in a service that processes XML data. An attacker can send a crafted XML payload as the body of a POST request to trigger the injection. No authentication is required. [1]

Exploitation

An attacker with network access to the camera can send a specially crafted XML document containing arbitrary commands to an exposed service. The commands are executed as root. No user interaction or prior authentication is needed. [1]

Impact

Successful exploitation allows an attacker to execute arbitrary commands with root privileges on the device, leading to full compromise, including data exfiltration, device control, or use in further attacks. [1]

Mitigation

As of the disclosure date, no official fix has been released. Users should isolate affected devices from untrusted networks or apply vendor updates if available. [1]