LiveActive security incident?Get immediate response
CVE Record

CVE-2024-34896: An issue in Nedis SmartLife Video Doorbell (WIFICDP10GY), Nedis SmartLife IOS v1.4.0 causes users who are d...

An issue in Nedis SmartLife Video Doorbell (WIFICDP10GY), Nedis SmartLife IOS v1.4.0 causes users who are disconnected from a previous peer-to-peer connection with the device to still have access to live video feed.

HighCVSS 7.5Not KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysishigh

Security readout for executives and security teams

Plain-English summary

This flaw can leave a live doorbell camera view accessible to someone who previously had a peer-to-peer connection, even after they were disconnected. The business impact is privacy exposure: video from homes, offices, or sensitive entrances may remain visible to a former user.

Executive priority

Prioritize review where these doorbells monitor private residences, executive areas, customer entrances, or regulated spaces. The issue is confidentiality-focused, but live video exposure can create serious privacy, trust, and physical-security concerns.

Technical view

CVE-2024-34896 describes improper revocation of live video access in Nedis SmartLife Video Doorbell WIFICDP10GY with Nedis SmartLife iOS v1.4.0. The CVSS 3.1 vector is network-accessible, low complexity, no privileges, no user interaction, with high confidentiality impact only.

Likely exposure

Exposure is most likely where this Nedis doorbell and the named iOS app version were used with shared, guest, former-user, or previously paired peer-to-peer access.

Exploitation context

The source bundle does not show CISA KEV listing or cite active exploitation. It also does not provide exploit details, patch status, or a vendor-confirmed affected-version matrix beyond the CVE description.

Researcher notes

Evidence is limited. The CVE record names the product and behavior, but affected metadata is marked n/a and no CWE is listed. The public bundle supports high confidentiality risk, not confirmed exploitation or a specific remediation.

Mitigation direction

  • Check Nedis or SmartLife vendor guidance for updates or replacement advice.
  • Update the iOS app and device firmware if vendor guidance confirms a fix.
  • Remove unnecessary shared users and previously authorized accounts.
  • Treat access revocation as unreliable until vendor guidance confirms remediation.
  • Disable or replace affected doorbells in privacy-sensitive locations if risk is unacceptable.

Validation and detection

  • Inventory Nedis SmartLife Video Doorbell WIFICDP10GY deployments.
  • Confirm whether Nedis SmartLife iOS v1.4.0 was used for pairing or access.
  • Review shared users, former users, and previous peer-to-peer access relationships.
  • Perform only privacy-safe revocation testing with authorized accounts.
  • Track CVE, vendor, and referenced research updates for patch confirmation.
Prepared
Confidence
medium
Sources
3

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2024-34896 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
High
CVSS
7.5 (3.1)
Known Exploited
No
Published

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

1CVSS vectors
3Timeline events
1ADP providers
2Source links

SSVC decision data

CISA-ADPCISA Coordinator
Timestamp
Version
2.0.3
Exploitation: noneAutomatable: yesTechnical Impact: partial

CVSS vector scores

1 official score

We collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.

ScoreVersionSeverityVectorExploitImpactSource
7.5CVSS 3.1HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N3.93.6CISA-ADP

Vulnerability scoring details

Base CVSS 3.1 score

7.5High
CVSS 3.1 vector shape for CVE-2024-34896Attack VectorAttack ComplexityPrivileges RequiredUser InteractionScopeConfidentiality ImpactIntegrity ImpactAvailability Impact

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Attack Vector
NetworkAdjacentLocalPhysical
Attack Complexity
LowHigh
Privileges Required
NoneLowHigh
User Interaction
NoneRequired
Scope
ChangedUnchanged
Confidentiality Impact
HighLowNone
Integrity Impact
HighLowNone
Availability Impact
HighLowNone

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

ADP provider summaries

CISA-ADPCISA ADP Vulnrichment
cvssV3_1other:ssvc

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
n/an/an/aListed
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.