A critical vulnerability affecting AVTECH IP cameras has been exploited by threat actors as a zero-day, adding the devices to a botnet. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) disclosed the details earlier this month, emphasizing the flaw’s low attack complexity and remote exploitability.
CISA warned in an alert published on August 1, 2024, that successful exploitation could allow attackers to inject and execute commands with the permissions of the running process. The vulnerability impacts AVM1203 camera models with firmware versions up to and including FullImg-1023-1007-1011-1009. Although these devices are no longer produced, they are still in use in sectors like commercial facilities, financial services, healthcare, public health, and transportation systems.
The web infrastructure company noted that attackers managing these botnets have been leveraging new or less-known vulnerabilities to spread malware.