Unauthenticated OS command injection in AVTECH IP camera brightness function (CVE-2024-7029)
Information currently not available to provide a detailed vulnerability description beyond what is in the provided content. Provided content indicates CVE-2024-7029 is an unauthenticated network-reachable command injection affecting AVTECH IP cameras, reportedly in a brightness-related function/endpoint, allowing injection and execution of commands on the device.
Are you exposed to this one?
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
Impact, mitigation & remediation
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
Impact
What an attacker gets, and what they’ve been doing with it.
Mitigation
If you can’t patch tonight, do this now.
Remediation
Patch, then assume compromise.
Exploits
3 valid exploits after Mallory filtered fakes, detection scripts, and README-only repos.
This repository contains a Python proof-of-concept exploit for CVE-2024-7029, a remote code execution vulnerability in AvTech devices. The main file, GenAvTechRCEExploit.py, provides functionality to scan single or multiple targets for the vulnerability and, if found, allows the attacker to execute arbitrary shell commands via an interactive shell. The exploit works by sending a crafted POST request to the /cgi-bin/supervisor/Factory.cgi endpoint on the target device, injecting shell commands through the 'brightness' parameter. The tool supports multithreaded scanning of targets listed in a file and provides user-friendly output. The README.md offers detailed usage instructions in both English and Russian. No hardcoded IPs or domains are present; the tool is designed for user-supplied targets. The exploit is a standalone script and does not belong to any exploitation framework.
This repository contains a single Python exploit script (CVE-2024-7029.py) and a minimal README. The exploit targets AvTech devices vulnerable to CVE-2024-7029, a remote code execution (RCE) flaw in the /cgi-bin/supervisor/Factory.cgi endpoint. The script allows an attacker to check if a target is vulnerable and, if so, provides an interactive shell-like interface to execute arbitrary commands on the device. It supports both single-target and multi-target (file-based) scanning, with optional threading for efficiency. The exploit works by sending a specially crafted POST request to the vulnerable endpoint, injecting shell commands via the 'brightness' parameter. The code is a proof-of-concept (POC) and does not include advanced features such as payload customization or post-exploitation modules. The only fingerprintable endpoint is the Factory.cgi path, which is typical for AvTech devices. The repository is straightforward, with the main exploit logic contained in a single Python file.
This repository contains a C# (.NET 8) Proof-of-Concept exploit for CVE-2024-7029, a critical authentication bypass and remote code execution vulnerability in AVTech devices. The main code is in Program.cs, which provides a console interface for the user to specify a target URL or a file containing multiple targets. The exploit works by sending a crafted HTTP POST request to the endpoint '/cgi-bin/supervisor/Factory.cgi' on the target device, injecting arbitrary shell commands via the 'brightness' parameter. If the target is vulnerable, the tool provides an interactive shell, allowing the user to execute further commands remotely and view their output. The repository includes standard .NET project and solution files, as well as documentation in both English and Farsi. No external dependencies or frameworks are used. The exploit is operational and can be used to confirm and leverage the vulnerability on affected AVTech devices.
Affected products & vendors
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.
Recent activity
4 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A command injection vulnerability in AVTECH end-of-life IP cameras (in the brightness function) enabling remote code execution/command execution with elevated privileges, leading to device compromise and botnet enrollment.
A command injection vulnerability in AVTECH CCTV devices, exploited by RondoDox.
A vulnerability in AVTECH devices exploited by the RondoDox botnet.
The version that knows your environment.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.