Loading vulnerability…
CVE-2024-7029 is a command-injection vulnerability in the brightness functionality of AVTECH IP cameras. Attacker-controlled input to the brightness argument associated with the action parameter permits network-delivered commands to execute without authentication, with the privileges of the running process owner. Confirmed affected devices are AVTECH AVM1203 cameras running firmware FullImg-1023-1007-1011-1009 and earlier. Other AVTECH cameras and network video recorders may also be affected, but additional models are not confirmed. The vulnerability has been exploited to deploy Mirai variants and ClingSTUN.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
If you can’t patch tonight, do this now.
Patch, then assume compromise.
3 valid exploits after Mallory filtered fakes, detection scripts, and README-only repos.
This repository contains a Python proof-of-concept exploit for CVE-2024-7029, a remote code execution vulnerability in AvTech devices. The main file, GenAvTechRCEExploit.py, provides functionality to scan single or multiple targets for the vulnerability and, if found, allows the attacker to execute arbitrary shell commands via an interactive shell. The exploit works by sending a crafted POST request to the /cgi-bin/supervisor/Factory.cgi endpoint on the target device, injecting shell commands through the 'brightness' parameter. The tool supports multithreaded scanning of targets listed in a file and provides user-friendly output. The README.md offers detailed usage instructions in both English and Russian. No hardcoded IPs or domains are present; the tool is designed for user-supplied targets. The exploit is a standalone script and does not belong to any exploitation framework.
This repository contains a single Python exploit script (CVE-2024-7029.py) and a minimal README. The exploit targets AvTech devices vulnerable to CVE-2024-7029, a remote code execution (RCE) flaw in the /cgi-bin/supervisor/Factory.cgi endpoint. The script allows an attacker to check if a target is vulnerable and, if so, provides an interactive shell-like interface to execute arbitrary commands on the device. It supports both single-target and multi-target (file-based) scanning, with optional threading for efficiency. The exploit works by sending a specially crafted POST request to the vulnerable endpoint, injecting shell commands via the 'brightness' parameter. The code is a proof-of-concept (POC) and does not include advanced features such as payload customization or post-exploitation modules. The only fingerprintable endpoint is the Factory.cgi path, which is typical for AvTech devices. The repository is straightforward, with the main exploit logic contained in a single Python file.
This repository contains a C# (.NET 8) Proof-of-Concept exploit for CVE-2024-7029, a critical authentication bypass and remote code execution vulnerability in AVTech devices. The main code is in Program.cs, which provides a console interface for the user to specify a target URL or a file containing multiple targets. The exploit works by sending a crafted HTTP POST request to the endpoint '/cgi-bin/supervisor/Factory.cgi' on the target device, injecting arbitrary shell commands via the 'brightness' parameter. If the target is vulnerable, the tool provides an interactive shell, allowing the user to execute further commands remotely and view their output. The repository includes standard .NET project and solution files, as well as documentation in both English and Farsi. No external dependencies or frameworks are used. The exploit is operational and can be used to confirm and leverage the vulnerability on affected AVTech devices.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.
18 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A remote code execution vulnerability affecting AVTECH IP cameras. The query identifies 12 malicious scanner IPs associated with exploitation attempts. Successful compromise is not established by the content.
A vulnerability in AVTECH AVM1203 cameras exploited by ClingSTUN and previously associated with a separate Mirai campaign. Reuse of this vulnerability does not establish shared operators or a malware-family relationship.
A vulnerability in AVTECH AVM1203 cameras exploited by ClingSTUN and previously used in a separate Mirai campaign. Reuse of the vulnerability does not establish shared operators or a malware-family relationship.
A command injection vulnerability in AVTECH AVM1203's Factory.cgi endpoint, exploited to distribute ClingSTUN.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.