An issue was discovered in za-internet C-MOR Video Surveillance 5.2401. Due to improper privilege management concerning sudo privileges, C-MOR is vulnerable to a privilege escalation attack. The Linux user www-data running the C-MOR web interface can execute some OS commands as root via Sudo without having to enter the root password. These commands, for example, include cp, chown, and chmod, which enable an attacker to modify the system's sudoers file in order to execute all commands with root privileges. Thus, it is possible to escalate the limited privileges of the user www-data to root privileges.
References
| Link | Resource |
|---|---|
| https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2024-027.txt | Exploit Vendor Advisory |
| https://www.syss.de/pentest-blog/mehrere-sicherheitsschwachstellen-in-videoueberwachungssoftware-c-mor-syss-2024-020-bis-030 | Vendor Advisory |
| http://seclists.org/fulldisclosure/2024/Sep/20 | Exploit Mailing List Third Party Advisory |
Configurations
Configuration 1 (hide)
|
History
04 Sep 2025, 16:32
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2024-027.txt - Exploit, Vendor Advisory | |
| References | () https://www.syss.de/pentest-blog/mehrere-sicherheitsschwachstellen-in-videoueberwachungssoftware-c-mor-syss-2024-020-bis-030 - Vendor Advisory | |
| References | () http://seclists.org/fulldisclosure/2024/Sep/20 - Exploit, Mailing List, Third Party Advisory | |
| First Time |
C-mor
C-mor c-mor Video Surveillance |
|
| CPE | cpe:2.3:a:c-mor:c-mor_video_surveillance:5.2401:*:*:*:*:*:*:* cpe:2.3:a:c-mor:c-mor_video_surveillance:6.00:patch_level_01:*:*:*:*:*:* |
Information
Published : 2024-09-05 15:15
Updated : 2025-09-04 16:32
NVD link : CVE-2024-45173
Mitre link : CVE-2024-45173
CVE.ORG link : CVE-2024-45173
JSON object : View
Products Affected
c-mor
- c-mor_video_surveillance
CWE
CWE-269
Improper Privilege Management