ICSA-24-235-03: Authenticated Remote Code Execution affects Mobotix P3 and Mx6 cameras

CISA's summary

Summary: A vulnerability was found in the P3 and Mx6 cameras that allows a logged-in attacker to execute arbitrary commands with system rights.

Products, as the advisory lists them

DeSpy has not checked any unit, hardware revision or firmware.

Vulnerabilities in this advisory

• CVE-2023-34873 — Authenticated Remote Code Execution · CWE-146

  The tcpdump feature does not properly validate input, which allows authenticated users to execute code.

Acknowledgments, as the advisory lists them

• CISA: discovering and reporting a public Proof of Concept (PoC)
• BSI: reporting the vulnerability and supporting the coordination

The advisory's legal notice

This document is provided on an "AS IS" basis and does not imply any kind of guarantee or warranty, including the warranties of merchantability or fitness for a particular use. Your use of the information on the document or materials linked from the document is at your own risk. Mobotix reserves the right to change or update this document at any time.

Sources

• The advisory at cisa.gov
• The CSAF document (JSON)

DeSpy's copy of this version is dated 2026-09-28.