F24: Hikvision-compatible URL parser overflow (V3.5.2.1)
original finding or lead
Last updated November 8, 2026
Document type: local CVE candidate assessment, not a published CVE Record. CVE ID: unassigned. Product scope: Anpviz IPC-D240W-S V3.5.2.1 captured from the owner’s MCA40E camera; the V3.6.3.1 comparison image is an MCA50E image sent in error and was not flashed to this model.
Finding
Both images copy a URL substring into a 128-byte stack buffer without a bound.
Status in this image: original finding or lead.
Evidence limit: Complete pre-auth reachability, crash and code execution are unverified.
Classification and severity
- Proposed CWE: CWE-121, CWE-787
- CVSS v4.0 score: Not scored — current evidence does not support a defensible numeric impact/attack vector, this version lacks the issue, or the specific defect was fixed.
- CVSS v4.0 vector: Not assigned.
- Scoring basis: Complete pre-auth reachability, crash and code execution are unverified.
- CVE candidacy: Needs coordinator/CNA review for grouping, affected models and version status; do not equate this finding ID with a CVE ID.
Source screenshots
The PNGs are rendered, line-numbered excerpts of existing Ghidra C-like decompilation, not photographs of the Ghidra GUI or recovered vendor source. The original export is authoritative; image selection can omit relevant lines elsewhere in the function.
- F24: Hikvision-compatible URL copy — F24-hik_url_parser-old —
V3.5.2.1/F24/F24-hik_url_parser-old.clines 82–98; source SHA-256c97d218ff6341ed57a0df0906f73bd145997becf3d01d628bac11b4a52f3633e. - F24: Hikvision-compatible URL copy — F24-hik_url_parser-old —
V3.5.2.1/F24/F24-hik_url_parser-old.clines 1419–1435; source SHA-256c97d218ff6341ed57a0df0906f73bd145997becf3d01d628bac11b4a52f3633e.
Related published CVEs
- No verified related CVE linked to this specific finding; this is not an exhaustive database search.
Case references
- Evidence index
- Initial public report
- Remediation review
- CERT/CC VRF #26-10-FZTVG; CISA Case #116607.