Executive brief
A vulnerability in the Nous W3 Smart WiFi Camera allows an individual with physical access to the device to take complete control of it. By inserting a specially prepared SD card, an attacker can bypass security controls to gain administrative access, potentially allowing them to view private video feeds or disable the camera. This issue stems from the device failing to properly verify the authenticity of software updates provided via the memory card slot.
Technical details
A privilege escalation vulnerability exists in the firmware update mechanism of the Nous W3 Smart WiFi Camera (v1.33.50.82). The device's update scripts (including tf_update.sh and update.sh) fail to sufficiently verify the authenticity of update packages beyond basic MD5 checks, which do not prevent malicious modifications. An unauthenticated attacker with physical access can insert a FAT32-formatted SD card containing a crafted 'update.tar' archive. Upon boot or update trigger, the device executes the contained scripts with root privileges, allowing for arbitrary code execution, modification of /etc/shadow for persistent root access, and full system compromise. As of the advisory date, no official patch is available.
Affected products
- Nous W3 Smart WiFi Camera 1.33.50.82
Timeline
- 2025-07-18: disclosed: Initial disclosure to Nous Technology
- 2025-07-22: other: Vendor responded stating the port is intended for initial configuration only
- 2025-09-30: other: CVE-2025-56438 assigned by MITRE
- 2025-10-24: advisory: Public disclosure of vulnerability details