{"id":"CVE-2024-35343","aliases":["EUVD-2024-35291"],"status":"published","description":"Certain Anpviz products allow unauthenticated users to download arbitrary files from the device's filesystem via a HTTP GET request to the /playback/ URI. This affects IPC-D250, IPC-D260, IPC-B850, IPC-D850, IPC-D350, IPC-D3150, IPC-D4250, IPC-D380, IPC-D880, IPC-D280, IPC-D3180, MC800N, YM500L, YM800N_N2, YMF50B, YM800SV2, YM500L8, and YM200E10 (IP Cameras) firmware v3.2.2.2 and lower and possibly more vendors/models of IP camera.","severity":{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-09","score":0.00475,"percentile":0.41352,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-200"],"published":"2024-05-28T16:46:52Z","modified":"2026-06-17T07:34:46Z","products":[{"vendor":"anpviz","product":"ipc-b850_firmware"},{"vendor":"anpviz","product":"ipc-d250_firmware"},{"vendor":"anpviz","product":"ipc-d260_firmware"},{"vendor":"anpviz","product":"ipc-d280_firmware"},{"vendor":"anpviz","product":"ipc-d3150_firmware"},{"vendor":"anpviz","product":"ipc-d3180_firmware"},{"vendor":"anpviz","product":"ipc-d350_firmware"},{"vendor":"anpviz","product":"ipc-d380_firmware"},{"vendor":"anpviz","product":"ipc-d4250_firmware"},{"vendor":"anpviz","product":"ipc-d850_firmware"},{"vendor":"anpviz","product":"ipc-d880_firmware"},{"vendor":"anpviz","product":"mc800n_firmware"},{"vendor":"anpviz","product":"ym200e10_firmware"},{"vendor":"anpviz","product":"ym500l8_firmware"},{"vendor":"anpviz","product":"ym800n_n2_firmware"},{"vendor":"anpviz","product":"ym800sv2_firmware"},{"vendor":"anpviz","product":"ymf50b_firmware"}],"references":[{"url":"https://willgu.es/pages/anpviz-ip-camera-vuln.html","tags":["x_transferred"]}],"sources":{"cve":[{"id":"CVE-2024-35343","description":"Certain Anpviz products allow unauthenticated users to download arbitrary files from the device's filesystem via a HTTP GET request to the /playback/ URI. This affects IPC-D250, IPC-D260, IPC-B850, IPC-D850, IPC-D350, IPC-D3150, IPC-D4250, IPC-D380, IPC-D880, IPC-D280, IPC-D3180, MC800N, YM500L, YM800N_N2, YMF50B, YM800SV2, YM500L8, and YM200E10 (IP Cameras) firmware v3.2.2.2 and lower and possibly more vendors/models of IP camera.","status":"published","published":"2024-05-28T16:46:52.274Z","modified":"2025-02-13T15:54:11.605Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"adp"}],"cwes":["CWE-200"],"updated_at":"2026-11-02T14:34:20.313092Z"}],"euvd":[{"id":"EUVD-2024-35291","description":"Certain Anpviz products allow unauthenticated users to download arbitrary files from the device's filesystem via a HTTP GET request to the /playback/ URI. This affects IPC-D250, IPC-D260, IPC-B850, IPC-D850, IPC-D350, IPC-D3150, IPC-D4250, IPC-D380, IPC-D880, IPC-D280, IPC-D3180, MC800N, YM500L, YM800N_N2, YMF50B, YM800SV2, YM500L8, and YM200E10 (IP Cameras) firmware v3.2.2.2 and lower and possibly more vendors/models of IP camera.","status":"published","published":"2024-05-28T16:46:52Z","modified":"2025-02-13T15:54:11Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-03T00:03:54.170588Z"}],"nvd":[{"id":"CVE-2024-35343","description":"Certain Anpviz products allow unauthenticated users to download arbitrary files from the device's filesystem via a HTTP GET request to the /playback/ URI. This affects IPC-D250, IPC-D260, IPC-B850, IPC-D850, IPC-D350, IPC-D3150, IPC-D4250, IPC-D380, IPC-D880, IPC-D280, IPC-D3180, MC800N, YM500L, YM800N_N2, YMF50B, YM800SV2, YM500L8, and YM200E10 (IP Cameras) firmware v3.2.2.2 and lower and possibly more vendors/models of IP camera.","status":"published","published":"2024-05-28T17:15:10.58Z","modified":"2026-06-17T07:34:46.48Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"secondary"}],"cwes":["CWE-200"],"updated_at":"2026-11-02T14:10:02.520903Z"}]}}