CVE-2024-51347
Published: 25 March 2026
Summary
CVE-2024-51347 is a high-severity Classic Buffer Overflow (CWE-120) vulnerability. Its CVSS base score is 7.2 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 18.6th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2024-51347 is a buffer overflow vulnerability (CWE-120) affecting the dgiot binary in the LSC Smart Indoor IP Camera running firmware version V7.6.32. The issue arises in the ONVIF configuration interface during handling of the Time Zone (TZ) parameter, where the input length is not properly validated before being copied into a fixed-size buffer via the insecure strcpy function. This flaw has a CVSS v3.1 base score of 7.2 (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H), indicating high severity with network accessibility and significant impacts on confidentiality, integrity, and availability.
An attacker with high privileges (PR:H) can exploit this vulnerability over the network with low complexity and no user interaction required. By sending a specially crafted TZ parameter to the ONVIF interface, the attacker triggers the buffer overflow, potentially leading to arbitrary code execution, data corruption, or denial of service on the affected device.
Details on the vulnerability, including proof-of-concept information, are available in the security research repository at https://github.com/victorGoeman/LSC-Indoor-Camera-Security-Research/blob/main/CVE-2024-51347.md and related resources. No official vendor patches or mitigation guidance are specified in the available information.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-55500
Vulnerability details
A buffer overflow vulnerability in the dgiot binary in LSC Smart Indoor IP Camera V7.6.32. The flaw exists in the handling of the Time Zone (TZ) parameter within the ONVIF configuration interface. The time zone (TZ) parameter does not have…
more
its length properly validated before being copied into a fixed-size buffer using the insecure strcpy function.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Buffer overflow in network-accessible ONVIF config interface directly enables remote code execution on a public-facing device service.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly requires validation of the TZ parameter length before copying into fixed-size buffers, preventing the buffer overflow vulnerability.
Mandates identification, reporting, correction, and verification of flaws like this buffer overflow in the dgiot binary, enabling patching of the vulnerable firmware.
Implements memory safeguards such as non-executable stacks and address randomization to mitigate exploitation of the buffer overflow for arbitrary code execution.