What’s Vulnerable › Vulnerabilities
CVE-2020-29001
- Severity: high (CVSS 7.2 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 1.3% probability of exploitation in the next 30 days
- Public exploit or detection template: yes
- Published: 2021-01-26 · updated 2026-06-17
- Weakness: CWE-312
Description
An issue was discovered on Geeni GNC-CW028 Camera 2.7.2, Geeni GNC-CW025 Doorbell 2.9.5, Merkury MI-CW024 Doorbell 2.9.6, and Merkury MI-CW017 Camera 2.9.6 devices. A vulnerability exists in the RESTful Services API that allows a remote attacker to take full control of the camera with a high-privileged account. The vulnerability exists because a static username and password are compiled into the ppsapp RESTful application.
Affected products
- Merkuryinnovations Geeni Gnc-Cw025 Firmware: 2.9.5
- Merkuryinnovations Geeni Gnc-Cw028 Firmware: 2.7.2
- Merkuryinnovations Merkury Mi-Cw017 Firmware: 2.9.6
- Merkuryinnovations Merkury Mi-Cw024 Firmware: 2.9.6
References
- https://gist.github.com/tj-oconnor/371d34342c0cc2be015cc89d6dc2bc66
- https://support.mygeeni.com/hc/en-us
- https://gist.github.com/tj-oconnor/371d34342c0cc2be015cc89d6dc2bc66
- https://support.mygeeni.com/hc/en-us
Get alerted when CVE-2020-29001 or the next vulnerability affects your stack