Skip to content
Matt D.

N1: Potential unauthenticated upload routes (V3.5.2.1)

not present or not assessed in old image

Last updated November 8, 2026

← All findings · Repository

Document type: local CVE candidate assessment, not a published CVE Record. CVE ID: unassigned. Product scope: Anpviz IPC-D240W-S V3.5.2.1 captured from the owner’s MCA40E camera; the V3.6.3.1 comparison image is an MCA50E image sent in error and was not flashed to this model.

Finding

The new ONVIF and HTTP firmware/config/key upload routes appear to depend on OnvifAuth, which defaults off, and firmware upload reaches the unsigned updater.

Status in this image: not present or not assessed in old image.

Evidence limit: High-priority static lead. Request-handler decompilation is ambiguous; no live unauthenticated upload was tested.

Classification and severity

  • Proposed CWE: CWE-306, CWE-862
  • CVSS v4.0 score: Not scored — current evidence does not support a defensible numeric impact/attack vector, this version lacks the issue, or the specific defect was fixed.
  • CVSS v4.0 vector: Not assigned.
  • Scoring basis: High-priority static lead. Request-handler decompilation is ambiguous; no live unauthenticated upload was tested.
  • CVE candidacy: Needs coordinator/CNA review for grouping, affected models and version status; do not equate this finding ID with a CVE ID.

Source screenshots

The PNGs are rendered, line-numbered excerpts of existing Ghidra C-like decompilation, not photographs of the Ghidra GUI or recovered vendor source. The original export is authoritative; image selection can omit relevant lines elsewhere in the function.

  • No dedicated C export or code screenshot for this finding/version. See the case review and supporting evidence; no source was invented.
  • No verified related CVE linked to this specific finding; this is not an exhaustive database search.

Case references