CVE-2023-49236 is a critical flaw, scored 9.8, in the TRENDnet TV-IP1314PI network camera: a stack-based buffer overflow in the RTSP playback function of davinci leads to arbitrary command execution. The record lists firmware 5.5.3 200714. The references name no fixed version, so check TRENDnet for an update and keep the camera off the internet.
What's affected
The record says a stack-based buffer overflow in the TV-IP1314PI at 5.5.3 200714 leads to arbitrary command execution. The cause is a lack of length validation during an sscanf of a user entered scale field in the RTSP playback function of the davinci program. The NVD vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. The record gives no fixed version and the references are researcher material rather than a vendor bulletin. I could not retrieve the referenced write up, so this post relies on the NVD record and says so. Check TRENDnet's support pages for a newer firmware before you plan around a patch.
How to check if you're exposed
The record names one exact firmware build, 5.5.3 200714, on the TV-IP1314PI. Open the camera's web interface and read the firmware version on its system or device information page. If it matches 5.5.3 200714, it is in the affected set named by the record.
From a network perspective, find these devices by looking for TRENDnet cameras in your asset inventory or network scan results. There is no package manager command for a camera firmware, so inventory is the only dependable check.
What to do now
- Identify every TRENDnet TV-IP1314PI camera and read its firmware version.
- Check TRENDnet's support site for a firmware newer than 5.5.3 200714. The references for this CVE are researcher write ups, not a vendor advisory, so confirm the status with the vendor.
- Remove the camera's web and streaming ports from the internet, and put the camera on its own network segment.
- If no fixed firmware exists, plan to replace the device, or keep it isolated behind a firewall that only admits your video recorder.
- Record the decision in your asset inventory so the camera does not reappear as an unknown.
Why it matters
The record lists CWE-787, out-of-bounds write, and CWE-121, stack-based buffer overflow. The bug is a classic one: a format function copies input into a fixed size buffer without checking how long the input is.
RTSP is the protocol many cameras use to stream video, so the vulnerable function sits in a service that is meant to be reachable from other machines. That is why exposing a camera's streaming port to the internet is a bad idea even when the web interface is locked down.
KEV status is false for this CVE. Three CVEs were published together for this camera on 9 January 2024, so the device should be treated as a group problem, not three separate tickets.
Quick check
Why is RTSP exposure relevant?
The flaw is in the RTSP playback function, which is a network facing service. Anything that can reach the camera's RTSP port can reach the vulnerable code.
Is there a vendor patch?
The record and its references do not name one. Check TRENDnet before assuming either way.
Sources
Last reviewed: 19 October 2026.
