CVE-2024-54848

Vulnerability

The CP Plus CP-VNR-3104 (model B3223P22C02424) network video recorder suffers from improper handling and storage of certificates [1][3]. This flaw arises because the device does not securely store its cryptographic certificates, potentially exposing private keys or allowing unauthorized access to certificate material. The affected firmware version is explicitly identified as B3223P22C02424. An attacker with network access to the device can exploit this weakness to undermine the confidentiality of encrypted communications.

Exploitation

To exploit this vulnerability, an attacker must have network access to the CP-VNR-3104 device, either on the same local network or through remote connectivity if exposed. No prior authentication is required to access the improperly stored certificates. The attacker can first extract the certificate material from the device's storage (e.g., via firmware analysis or direct file system access) [1]. Using the compromised certificates, the attacker can then decrypt captured network traffic or insert themselves into the communication path to perform a man-in-the-middle attack, intercepting and potentially modifying data in transit.

Impact

Successful exploitation allows an attacker to decrypt communications that should be protected by TLS or other encryption, leading to information disclosure of sensitive video feeds, credentials, or configuration data. Additionally, by mounting a man-in-the-middle attack, the attacker can impersonate trusted endpoints, further compromising the integrity and confidentiality of all data exchanged with the device. The attacker effectively bypasses the security guarantees of the encryption, achieving a high-impact breach of confidentiality and integrity with minimal access requirements.

Mitigation

As of publication date 2025-01-10, CP Plus has not released a patched firmware version for the CP-VNR-3104 (B3223P22C02424) that addresses this certificate storage issue [3]. No official workaround has been documented in the available references. Users are advised to restrict network access to the device, isolate it from untrusted networks, and monitor for future firmware updates from the vendor. This vulnerability is not listed in CISA's Known Exploited Vulnerabilities (KEV) catalog as of the publication date.