Cyber Posture

CVE-2024-51348

High

Published: 25 March 2026

Published
25 March 2026
Modified
25 March 2026
KEV Added
Patch
CVSS Score 8.8 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0021 43.5th percentile
Risk Priority 18 60% EPSS · 20% KEV · 20% CVSS

Description

A stack-based buffer overflow vulnerability in the P2P API service in BS Producten Petcam with firmware 33.1.0.0818 allows unauthenticated attackers within network range to overwrite the instruction pointer and achieve Remote Code Execution (RCE) by sending a specially crafted HTTP…

more

request.

Mitigating Controls (NIST 800-53 r5)AI

prevent

Remediates the specific stack-based buffer overflow in the P2P API service of firmware 33.1.0.0818 to eliminate the RCE vulnerability.

prevent

Implements memory protections like stack canaries and non-executable stacks to block instruction pointer overwrite from buffer overflow exploits.

prevent

Validates incoming HTTP requests to the P2P API service for proper length and format to prevent triggering the stack-based buffer overflow.

Security SummaryAI

CVE-2024-51348 is a stack-based buffer overflow vulnerability (CWE-121) in the P2P API service of BS Producten Petcam devices running firmware version 33.1.0.0818. The flaw enables unauthenticated attackers within network range to overwrite the instruction pointer, leading to remote code execution (RCE) through a specially crafted HTTP request. It has a CVSS v3.1 base score of 8.8 (AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), indicating high severity due to its potential for complete system compromise.

Attackers can exploit this vulnerability without authentication or user interaction, provided they are adjacent on the local network (AV:A). By sending a malicious HTTP request to the P2P API service, they can trigger the buffer overflow, overwrite critical memory including the instruction pointer, and execute arbitrary code on the device. This grants high-impact control over confidentiality, integrity, and availability, potentially allowing full device takeover, data exfiltration, or use as a pivot for further network attacks.

Detailed research and technical analysis, including proof-of-concept details, are available in the security research repository at https://github.com/victorGoeman/BS-Producten-Petcam-Security-Research/blob/main/CVE-2024-51348.md and the associated README at https://github.com/victorGoeman/BS-Producten-Petcam-Security-Research/blob/main/README.md. No vendor patches or official mitigation guidance are specified in the available information.

Details

CWE(s)

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
Why these techniques?

Stack-based buffer overflow in the unauthenticated P2P API service (exposed via HTTP) enables adjacent network attackers to achieve remote code execution, directly facilitating T1190: Exploit Public-Facing Application.

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

References