A high-severity vulnerability affecting HanwhaVision camera systems has been published to the National Vulnerability Database and the GitHub Advisory Database. CVE-2024-54012 (paired with a related CVE-2024-54013) carries a CVSS v4 base score of 8.5, and stems from an OS command injection flaw — specifically, insufficient input validation that allows specially crafted requests to execute arbitrary commands on the device.
The vulnerability was discovered by Penetration Testing engineers at Amazon and disclosed responsibly through Hanwha’s vulnerability reporting process. Hanwha has released patch firmware and published a technical report detailing the affected models and remediation steps.
What the CVSS Metrics Tell Us
The CVSS v4 vector for this flaw (AV:A/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H) indicates a few important operational details for anyone running affected cameras:
- Attack Vector: Adjacent — the attacker needs to be on the local or adjacent network segment, not exploiting the device over the open internet. This significantly narrows the realistic threat model for well-segmented sites.
- Privileges Required: High — the attacker needs elevated access to the target system before the command injection can be leveraged, which again reduces the pool of likely attackers to those who already have a meaningful foothold.
- Attack Complexity: Low, User Interaction: None — once the attacker has adjacent network access and sufficient privileges, exploitation itself is straightforward and doesn’t require tricking an operator into clicking anything.
- Impact: High across Confidentiality, Integrity and Availability — a successful exploit gives full compromise of the vulnerable camera, including the ability to run arbitrary OS commands.
The EPSS (Exploit Prediction Scoring System) score sits at 0.256%, placing it in the 17th percentile for real-world exploitation likelihood in the next 30 days. There is no indication in the current advisory of active exploitation in the wild.
Operational Implications for Sites Running HanwhaVision Gear
The combination of “Adjacent” attack vector and “High” privileges required means this is not a drive-by internet exploit — but it is exactly the kind of vulnerability that matters on networks where camera VLANs aren’t properly isolated from general office or guest traffic, or where camera admin credentials have been left at defaults or shared across a site.
For facilities and IT managers, the practical exposure comes down to three questions:
- Are HanwhaVision cameras on this site segmented onto a dedicated VLAN with restricted lateral access?
- Is the camera firmware currently at or above the patched version referenced in Hanwha’s vulnerability report?
- Are administrative credentials on the camera fleet unique and not shared with other network devices?
If the answer to any of these is uncertain, this is a reasonable trigger for a firmware audit across the camera estate. A confirmed OS command injection vulnerability, even one requiring adjacent access and elevated privileges, represents a real escalation path once an attacker has gained any foothold on a corporate or building network — which is a scenario security teams should always plan around rather than dismiss.
Mallen’s Take
This is a textbook example of why network segmentation matters as much as firmware currency in a video surveillance deployment. The CVSS profile here — adjacent vector, high privileges required — tells us Hanwha’s architecture isn’t trivially exposed to opportunistic internet scanning, but it does underline why camera networks should never share broadcast domains with staff or guest Wi-Fi, and why default admin credentials on IP cameras remain one of the most common findings we see during site audits.
Sites running HanwhaVision cameras should confirm current firmware versions against Hanwha’s published vulnerability report and schedule an update during the next maintenance window. This isn’t an emergency out-of-hours patch scenario given the access prerequisites, but it shouldn’t sit on a backlog for months either — particularly for properties where camera VLANs and general IT infrastructure share physical switching. If your site hasn’t had its network topology reviewed recently, this is a good prompt to revisit CCTV and video analytics segmentation as part of routine hardening.
Original source: https://github.com/advisories/GHSA-94qr-xmg5-q7cw