CVE-2024-58336

MediumCVSS 5.3/10Last modified Jun 17, 2026

Description

Akuvox Smart Intercom S539 contains an unauthenticated vulnerability that allows remote attackers to access live video streams by requesting the video.cgi endpoint on port 8080. Attackers can retrieve video stream data without authentication by directly accessing the specified endpoint on affected Akuvox doorphone and intercom devices.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-306

Affected software

Vendor	Product	Versions
The Akuvox Company	Akuvox Smart Doorphone	S539; S532; X916; X915; X912
The Akuvox Company	Akuvox Smart Intercom	R20K-2; R20A-2; C313W-2; NS-2; NC-2; NX-2

References

https://packetstormsecurity.com/files/180262/Broken Link
https://www.vulncheck.com/advisories/akuvox-smart-intercom-s-unauthenticated-video-stream-disclosureThird Party Advisory
https://www.zeroscience.mk/en/vulnerabilities/ZSL-2024-5826.phpThird Party Advisory
https://www.zeroscience.mk/en/vulnerabilities/ZSL-2024-5826.phpThird Party Advisory

Timeline

Published: Dec 30, 2025
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2024

CVE-2024-583374.3Akuvox Smart Intercom S539 contains an improper access control vulnerability that allows users with 'User' privileges to modify API access s CVE-2024-5833810.0Anevia Flamingo XL 3.2.9 contains a restricted shell vulnerability that allows remote attackers to escape the sandboxed environment through CVE-2024-583397.5LlamaIndex (run-llama/llama_index) versions up to and including 0.12.2 contain an uncontrolled resource consumption vulnerability in the Van CVE-2024-58348.8Inappropriate implementation in Dawn in Google Chrome prior to 126.0.6478.54 allowed a remote attacker to execute arbitrary code via a craft CVE-2024-583407.5LangChain versions up to and including 0.3.1 contain a regular expression denial-of-service (ReDoS) vulnerability in the MRKLOutputParser.pa CVE-2024-583418.2OpenCart Core 4.0.2.3 contains a SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecti CVE-2024-583426.1XenForo before 2.2.17 and 2.3.1 allows open redirect via a specially crafted URL. The getDynamicRedirect() function does not adequately vali CVE-2024-583434.3Vision Helpdesk before 5.7.0 (patched in 5.6.10) allows attackers to read user profiles via modified serialized cookie data to vis_client_id CVE-2024-583446.4Carbon Forum 5.9.0 contains a persistent cross-site scripting vulnerability that allows authenticated administrators to inject malicious Jav CVE-2024-583489.8WordPress Background Image Cropper version 1.2 contains a remote code execution vulnerability that allows unauthenticated attackers to uploa CVE-2024-583499.8WordPress Theme Travelscape 1.0.3 contains an arbitrary file upload vulnerability that allows unauthenticated attackers to upload malicious CVE-2024-58358.8Heap buffer overflow in Tab Groups in Google Chrome prior to 126.0.6478.54 allowed a remote attacker who convinced a user to engage in speci