Vstarcam
Monthly
A use-after-free in the P2P session teardown handler of VStarcam O-KAM SuperIPCam 1.3.3.32 (SuperIPCam.exe, function FUN_005a2d44) allows remote, unauthenticated attackers who can reach the camera's P2P connectivity feature to corrupt memory during session teardown, producing a partial loss of confidentiality, integrity and availability consistent with a denial-of-service crash rather than confirmed code execution. Only version 1.3.3.32 is identified as affected, and the vendor was contacted about the disclosure but did not respond. A public PoC reference exists (a GitHub gist linked from the VulDB entry); it is not verified as working exploit code, and there is no CISA KEV listing or other confirmation of active exploitation.
A stack-based buffer overflow (CWE-121) exists in the Windows client software VStarcam O-KAM Client 1.3.3.32, specifically inside the exported/imported function FUN_10003EA0 of the native library DevDll_925.dll. The vendor was contacted but did not respond and no vendor-released patch has been identified at time of analysis; the affected version is the only one confirmed in the CPE data (cpe:2.3:a:vstarcam:o-kam_client), so exposure is limited to users running that build. The issue is remotely reachable according to the CVSS 4.0 vector (AV:N/PR:N/UI:N, score 6.9; our assessed CVSS 3.1 vector scores it 6.5 with Low confidentiality, integrity and availability impact), and a public PoC reference exists in a GitHub gist; it is not verified as working exploit code and there is no CISA KEV confirmation of active exploitation. The exact feature, protocol, or code path that delivers attacker-controlled data into FUN_10003EA0 is not described in the available sources.
A use-after-free in the P2P session teardown handler of VStarcam O-KAM SuperIPCam 1.3.3.32 (SuperIPCam.exe, function FUN_005a2d44) allows remote, unauthenticated attackers who can reach the camera's P2P connectivity feature to corrupt memory during session teardown, producing a partial loss of confidentiality, integrity and availability consistent with a denial-of-service crash rather than confirmed code execution. Only version 1.3.3.32 is identified as affected, and the vendor was contacted about the disclosure but did not respond. A public PoC reference exists (a GitHub gist linked from the VulDB entry); it is not verified as working exploit code, and there is no CISA KEV listing or other confirmation of active exploitation.
A stack-based buffer overflow (CWE-121) exists in the Windows client software VStarcam O-KAM Client 1.3.3.32, specifically inside the exported/imported function FUN_10003EA0 of the native library DevDll_925.dll. The vendor was contacted but did not respond and no vendor-released patch has been identified at time of analysis; the affected version is the only one confirmed in the CPE data (cpe:2.3:a:vstarcam:o-kam_client), so exposure is limited to users running that build. The issue is remotely reachable according to the CVSS 4.0 vector (AV:N/PR:N/UI:N, score 6.9; our assessed CVSS 3.1 vector scores it 6.5 with Low confidentiality, integrity and availability impact), and a public PoC reference exists in a GitHub gist; it is not verified as working exploit code and there is no CISA KEV confirmation of active exploitation. The exact feature, protocol, or code path that delivers attacker-controlled data into FUN_10003EA0 is not described in the available sources.