{"id":76053,"date":"2025-09-21T21:21:47","date_gmt":"2025-09-21T21:21:47","guid":{"rendered":""},"modified":"2025-11-02T02:09:44","modified_gmt":"2025-11-02T08:09:44","slug":"cve-2025-50777-incorrect-access-control-vulnerability-in-aziot-2mp-full-hd-smart-wi-fi-cctv-home-security-camera","status":"publish","type":"post","link":"https:\/\/www.ameeba.com\/blog\/cve-2025-50777-incorrect-access-control-vulnerability-in-aziot-2mp-full-hd-smart-wi-fi-cctv-home-security-camera\/","title":{"rendered":"<strong>CVE-2025-50777: Incorrect Access Control Vulnerability in AZIOT 2MP Full HD Smart Wi-Fi CCTV Home Security Camera<\/strong>"},"content":{"rendered":"<p><strong>Overview<\/strong><\/p>\n<p>We will be discussing the security vulnerability CVE-2025-50777, which is found in the firmware of the AZIOT 2MP Full HD Smart Wi-Fi CCTV Home Security Camera, version V1.00.02. This vulnerability allows local attackers to gain root shell access due to an Incorrect Access Control vulnerability. Once accessed, the device exposes <a href=\"https:\/\/www.ameeba.com\/blog\/cve-2025-53584-critical-deserialization-of-untrusted-data-vulnerability-in-wp-ticket-customer-service-software\/\"  data-wpil-monitor-id=\"85883\">critical data<\/a> stored in plaintext, including Wi-Fi credentials and ONVIF service credentials. This <a href=\"https:\/\/www.ameeba.com\/blog\/cve-2025-9253-stack-based-buffer-overflow-on-linksys-wi-fi-range-extenders-leading-to-potential-system-compromise\/\"  data-wpil-monitor-id=\"84211\">potentially enables further compromise of the network and connected systems<\/a>. Given the widespread use of such cameras in surveillance, this <a href=\"https:\/\/www.ameeba.com\/blog\/cve-2025-5060-authentication-bypass-vulnerability-in-bravis-user-plugin-for-wordpress\/\"  data-wpil-monitor-id=\"85246\">vulnerability poses a significant risk to user<\/a> privacy and data security.<\/p>\n<p><strong>Vulnerability Summary<\/strong><\/p>\n<p>CVE ID: CVE-2025-50777<br \/>\nSeverity: High (7.8)<br \/>\nAttack Vector: Local<br \/>\nPrivileges Required: None<br \/>\nUser Interaction: None<br \/>\nImpact: <a href=\"https:\/\/www.ameeba.com\/blog\/cve-2025-9791-critical-vulnerability-in-tenda-ac20-16-03-08-05-leading-to-potential-system-compromise\/\"  data-wpil-monitor-id=\"84989\">Potential system<\/a> compromise, data leakage, and further compromise of network and connected systems<\/p>\n<p><strong>Affected Products<\/strong><\/p><div id=\"ameeb-1905300166\" class=\"ameeb-content-2 ameeb-entity-placement\"><div style=\"border-left: 4px solid #555; padding-left: 20px; margin: 48px 0; font-family: Roboto, sans-serif; color: #ffffff; line-height: 1.6; max-width: 700px;\">\r\n  <h2 style=\"margin-top: 0; font-size: 20px; font-weight: 600; display: flex; align-items: center;\">\r\n    <a href=\"https:\/\/www.ameeba.com\/chat\" style=\"display: inline-flex; align-items: center; margin-right: 8px;\">\r\n      <img decoding=\"async\" src=\"https:\/\/www.ameeba.com\/blog\/wp-content\/uploads\/2025\/10\/Best-App-icon-Ameeba.png\" alt=\"Ameeba Chat Icon\" style=\"width: 40px; height: 40px;\" \/>\r\n    <\/a>\r\n    A new way to communicate\r\n  <\/h2>\r\n\r\n  <p style=\"margin-bottom: 12px;\">\r\n    Ameeba Chat is built on encrypted identity, not personal profiles.\r\n  <\/p>\r\n\r\n  <p style=\"margin-bottom: 16px;\">\r\n    Message, call, share files, and coordinate with identities kept separate.\r\n  <\/p>\r\n\r\n  <ul style=\"list-style: none; padding-left: 0; margin-bottom: 20px;\">\r\n    <li>\u2022 Encrypted identity<\/li>\r\n    <li>\u2022 Ameeba Chat authenticates access<\/li>\r\n    <li>\u2022 Aliases and categories<\/li>\r\n    <li>\u2022 End-to-end encrypted chat, calls, and files<\/li>\r\n    <li>\u2022 Secure notes for sensitive information<\/li>\r\n  <\/ul>\r\n\r\n  <p style=\"font-style: italic; font-weight: 600; margin-bottom: 24px;\">\r\n    Private communication, rethought.\r\n  <\/p>\r\n\r\n  <div style=\"display: flex; flex-wrap: wrap; gap: 12px;\">\r\n    <a href=\"https:\/\/www.ameeba.com\/chat\/download\" style=\"background-color: #ffffff; color: #000000; padding: 10px 20px; text-decoration: none; border-radius: 6px; font-weight: 500;\">Download Ameeba Chat<\/a>\r\n    <a href=\"https:\/\/www.ameeba.com\/chat\" style=\"border: 1px solid #ffffff; color: #ffffff; padding: 10px 20px; text-decoration: none; border-radius: 6px; font-weight: 500;\">Learn More<\/a>\r\n  <\/div>\r\n<\/div>\r\n<\/div>\n<p>Product | Affected Versions<\/p>\n<p>AZIOT 2MP Full HD Smart Wi-Fi CCTV Home Security Camera | V1.00.02<\/p>\n<p><strong>How the Exploit Works<\/strong><\/p>\n<p>The <a href=\"https:\/\/www.ameeba.com\/blog\/cve-2025-50753-shell-access-vulnerability-in-mitrastar-gpt-2741gnac-n2-devices\/\"  data-wpil-monitor-id=\"85856\">vulnerability lies in the firmware\u2019s incorrect access<\/a> control mechanism. A <a href=\"https:\/\/www.ameeba.com\/blog\/cve-2025-48157-php-local-file-inclusion-vulnerability-in-michele-giorgi-formality\/\"  data-wpil-monitor-id=\"84666\">local attacker can exploit this vulnerability<\/a> to gain root shell access to the device. Upon gaining access, the attacker can retrieve <a href=\"https:\/\/www.ameeba.com\/blog\/cve-2025-49401-critical-deserialization-of-untrusted-data-vulnerability-in-expresstech-systems-quiz-and-survey-master\/\"  data-wpil-monitor-id=\"87193\">critical data<\/a> stored in plaintext, such as Wi-Fi credentials and ONVIF service credentials. This not only compromises the security of the device but also opens up <a href=\"https:\/\/www.ameeba.com\/blog\/cve-2025-54742-data-deserialization-vulnerability-in-wpevently-leading-to-possible-system-compromise\/\"  data-wpil-monitor-id=\"86408\">possibilities for further network intrusions and compromises of connected systems<\/a>.<\/p>\n<p><strong>Conceptual Example Code<\/strong><\/p><div id=\"ameeb-719042405\" class=\"ameeb-content ameeb-entity-placement\"><div class=\"poptin-embedded\" data-id=\"f6b387694f681\"><\/div>\r\n\r\n\r\n\r\n\r\n\r\n<\/div>\n<p>Imagine an attacker having <a href=\"https:\/\/www.ameeba.com\/blog\/cve-2025-37103-hard-coded-login-credentials-vulnerability-in-hpe-networking-instant-on-access-points\/\"  data-wpil-monitor-id=\"92135\">access to the local network<\/a>. They might use a shell command like this to gain <a href=\"https:\/\/www.ameeba.com\/blog\/cve-2025-52954-unauthorized-root-access-vulnerability-in-junos-os-evolved\/\"  data-wpil-monitor-id=\"88193\">root shell access<\/a>:<\/p>\n<pre><code class=\"\" data-line=\"\">nc TARGET_IP 23<\/code><\/pre>\n<p>Where `TARGET_IP` is the IP <a href=\"https:\/\/www.ameeba.com\/blog\/cve-2025-58280-object-heap-address-exposure-vulnerability-in-ark-ets\/\"  data-wpil-monitor-id=\"87224\">address of the vulnerable<\/a> AZIOT camera. Once connected, because of the incorrect <a href=\"https:\/\/www.ameeba.com\/blog\/cve-2025-28041-access-control-vulnerability-in-itranswarp-up-to-version-2-19\/\"  data-wpil-monitor-id=\"85978\">access control<\/a>, the attacker would have root access and could issue commands to retrieve the Wi-Fi and ONVIF service credentials.<br \/>\nPlease note this is a conceptual example and real-world exploitation might involve more complex steps and techniques.<\/p>\n<p><strong>Mitigation Guidance<\/strong><\/p>\n<p>Users of affected devices are strongly urged to apply the vendor patch as soon as it is available. In the meantime, users can utilize a Web Application Firewall (WAF) or an Intrusion Detection System (IDS) to detect and prevent potential exploitation attempts. Regularly updating and patching devices, as well as monitoring network traffic for suspicious activity, can also help mitigate the <a href=\"https:\/\/www.ameeba.com\/blog\/cve-2025-52930-high-risk-memory-corruption-vulnerability-in-sail-image-decoding-library\/\"  data-wpil-monitor-id=\"90876\">risk posed by such vulnerabilities<\/a>.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Overview We will be discussing the security vulnerability CVE-2025-50777, which is found in the firmware of the AZIOT 2MP Full HD Smart Wi-Fi CCTV Home Security Camera, version V1.00.02. This vulnerability allows local attackers to gain root shell access due to an Incorrect Access Control vulnerability. Once accessed, the device exposes critical data stored in [&hellip;]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"om_disable_all_campaigns":false,"footnotes":""},"categories":[1],"tags":[],"vendor":[],"product":[],"attack_vector":[],"asset_type":[],"severity":[],"exploit_status":[],"class_list":["post-76053","post","type-post","status-publish","format-standard","hentry","category-uncategorized"],"aioseo_notices":[],"_links":{"self":[{"href":"https:\/\/www.ameeba.com\/blog\/wp-json\/wp\/v2\/posts\/76053","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.ameeba.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.ameeba.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.ameeba.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.ameeba.com\/blog\/wp-json\/wp\/v2\/comments?post=76053"}],"version-history":[{"count":13,"href":"https:\/\/www.ameeba.com\/blog\/wp-json\/wp\/v2\/posts\/76053\/revisions"}],"predecessor-version":[{"id":85346,"href":"https:\/\/www.ameeba.com\/blog\/wp-json\/wp\/v2\/posts\/76053\/revisions\/85346"}],"wp:attachment":[{"href":"https:\/\/www.ameeba.com\/blog\/wp-json\/wp\/v2\/media?parent=76053"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.ameeba.com\/blog\/wp-json\/wp\/v2\/categories?post=76053"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.ameeba.com\/blog\/wp-json\/wp\/v2\/tags?post=76053"},{"taxonomy":"vendor","embeddable":true,"href":"https:\/\/www.ameeba.com\/blog\/wp-json\/wp\/v2\/vendor?post=76053"},{"taxonomy":"product","embeddable":true,"href":"https:\/\/www.ameeba.com\/blog\/wp-json\/wp\/v2\/product?post=76053"},{"taxonomy":"attack_vector","embeddable":true,"href":"https:\/\/www.ameeba.com\/blog\/wp-json\/wp\/v2\/attack_vector?post=76053"},{"taxonomy":"asset_type","embeddable":true,"href":"https:\/\/www.ameeba.com\/blog\/wp-json\/wp\/v2\/asset_type?post=76053"},{"taxonomy":"severity","embeddable":true,"href":"https:\/\/www.ameeba.com\/blog\/wp-json\/wp\/v2\/severity?post=76053"},{"taxonomy":"exploit_status","embeddable":true,"href":"https:\/\/www.ameeba.com\/blog\/wp-json\/wp\/v2\/exploit_status?post=76053"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}