Dcs 932l Firmware CVE-2025-5572

CVSS 8.8 reflects a severe vulnerability with network accessibility (AV:N), low attack complexity (AC:L), and high impact across confidentiality, integrity, and availability (C:H/I:H/A:H). However, the PR:L (Low Privilege Required) constraint is significant—exploitation requires valid authentication credentials. Real-world risk is ELEVATED but contextually bounded: (1) The vulnerability affects end-of-life products without vendor patches, eliminating the possibility of official remediation; (2) Public POC availability accelerates weaponization and lowers attacker skill barriers; (3) Typical deployment patterns (cameras on corporate/home networks often with weak default credentials) increase practical exploitability despite the PR:L requirement; (4) Absence of EPSS data limits probabilistic exploitation assessment, but public disclosure + POC availability typically correlates with EPSS scores >30-40%. This is NOT a low-real-risk-high-CVSS issue—authenticated code execution on network-accessible devices is operationally critical, particularly in surveillance infrastructure. Organizations using this model should treat it as priority regardless of CVSS alone.

An attacker with valid credentials (obtained via weak default passwords, phishing, or credential stuffing) accesses the DCS-932L web interface. The attacker crafts an HTTP request to /setSystemEmail with an oversized EmailSMTPPortNumber parameter (e.g., thousands of bytes instead of a valid port number 1-65535). The setSystemEmail function copies the unsanitized input directly onto the stack, overwriting adjacent memory including a saved return address. The attacker places shellcode within the payload or leverages return-oriented programming (ROP) gadgets present in the firmware. Upon function return, control flow redirects to attacker-controlled code, executing with the privileges of the camera process (typically root on embedded systems). The attacker achieves persistent code execution, enabling camera disable, credential theft, lateral network movement, or use of the camera as a botnet node. The low attack complexity and availability of POC code means this scenario can be automated and scaled across vulnerable device populations.