Skip to content
Matt D.

F6: Unsigned firmware update path (V3.5.2.1)

original finding or lead

Last updated November 8, 2026

← All findings · Repository

Document type: local CVE candidate assessment, not a published CVE Record. CVE ID: unassigned. Product scope: Anpviz IPC-D240W-S V3.5.2.1 captured from the owner’s MCA40E camera; the V3.6.3.1 comparison image is an MCA50E image sent in error and was not flashed to this model.

Finding

The package path uses CRC/MD5 without a publisher signature. The new package also contains a U-Boot image that this path can write.

Status in this image: original finding or lead.

Evidence limit: Old live testing confirmed package download and temporary interruption, not persistent installation or takeover; new image was not run.

Classification and severity

  • Proposed CWE: CWE-306, CWE-347
  • CVSS v4.0 score: 6.0 Medium, provisional scenario
  • CVSS v4.0 vector: CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
  • Scoring basis: Scored only for the observed old temporary availability loss and analogous conditional new path; no persistent firmware installation or takeover is assumed.
  • CVE candidacy: Needs coordinator/CNA review for grouping, affected models and version status; do not equate this finding ID with a CVE ID.

Source screenshots

The PNGs are rendered, line-numbered excerpts of existing Ghidra C-like decompilation, not photographs of the Ghidra GUI or recovered vendor source. The original export is authoritative; image selection can omit relevant lines elsewhere in the function.

  • No verified related CVE linked to this specific finding; this is not an exhaustive database search.

Case references

Source exports