CVE-2021-33549: Geutebrück and UDP Technology cameras stack buffer overflow in action parameter

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: medium.

high priorityRemote code execution in widely deployed camera firmware with public exploit code and very high EPSS, though exploitation requires prior high privileges on the device.

What it is

Multiple Geutebrück and UDP Technology camera firmware images contain a stack-based buffer overflow in the handling of the action parameter. A remote attacker who can reach the affected interface can overwrite stack memory and potentially execute arbitrary code on the device. Because these are network cameras, compromise can expose video streams and provide a foothold inside the surveillance network.

Impact

Successful exploitation allows remote code execution with the privileges of the vulnerable service, giving the attacker full control of the camera. From there an attacker could alter or disable recording, pivot to other hosts, or use the device as a persistent network implant.

Attack surface

The flaw is reachable over the network via the action parameter (CVSS vector AV:N), so no physical access is required. The vector shows PR:H, meaning the attacker must first hold high privileges on the device, and UI:N indicates no user interaction is needed.

Exploitation

CISA KEV does not list this CVE, but public exploit code is referenced (packetstormsecurity and randorisec tags), and EPSS is very high at roughly 0.66 probability (99th percentile), indicating active interest and likely weaponization.

What to do

• Apply the vendor firmware updates referenced in CISA ICS advisory ICSA-21-208-03 as the first action.
• Isolate cameras on a dedicated VLAN with no route to corporate or internet networks.
• Restrict management and API access to trusted administrative hosts and disable unused services.
• Replace or retire end-of-support camera models that will not receive a fix.
• Monitor vendor advisories for updated firmware for the listed G-CAM and G-Code models.

Detection

• Alert on HTTP requests containing unusually long or malformed action parameter values to camera management endpoints.
• Monitor camera devices for unexpected outbound connections, new listening ports, or process restarts.
• Baseline and alert on authentication events using high-privilege accounts on camera firmware.
• Watch for known exploit payload patterns from the referenced public exploit code in network IDS signatures.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.