CVE-2023-49237: Critical Command Injection in TRENDnet Camera Firmware

CVE-2023-49237 is a critical flaw, scored 9.8, in the TRENDnet TV-IP1314PI network camera: command injection happens because davinci uses the system function to unpack language packs without strict filtering of URL strings. The record lists firmware 5.5.3 200714. The references name no fixed version, so check TRENDnet for an update and keep the camera off the internet.

What's affected

The record says command injection can occur on the TV-IP1314PI at 5.5.3 200714 because the davinci program uses the system function to unpack language packs without strict filtering of URL strings. The NVD vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. The record gives no fixed version and the references are researcher material rather than a vendor bulletin. I could not retrieve the referenced write up, so this post relies on the NVD record and says so. Check TRENDnet's support pages for a newer firmware before you plan around a patch.

How to check if you're exposed

The record names one exact firmware build, 5.5.3 200714, on the TV-IP1314PI. Open the camera's web interface and read the firmware version on its system or device information page. If it matches 5.5.3 200714, it is in the affected set named by the record.

From a network perspective, find these devices by looking for TRENDnet cameras in your asset inventory or network scan results. There is no package manager command for a camera firmware, so inventory is the only dependable check.

What to do now

1. Identify every TRENDnet TV-IP1314PI camera and read its firmware version.
2. Check TRENDnet's support site for a firmware newer than 5.5.3 200714. The references for this CVE are researcher write ups, not a vendor advisory, so confirm the status with the vendor.
3. Remove the camera's web and streaming ports from the internet, and put the camera on its own network segment.
4. If no fixed firmware exists, plan to replace the device, or keep it isolated behind a firewall that only admits your video recorder.
5. Record the decision in your asset inventory so the camera does not reappear as an unknown.

Why it matters

The record lists CWE-77, command injection. Calling system with text that includes a value from outside means the shell interprets that text. Strict filtering, or avoiding the shell altogether, is the fix developers reach for.

Language pack handling is an unglamorous feature, which is partly why it was reachable with weak checks. Features at the edge of a product's purpose tend to get less review than the main ones.

KEV status is false for this CVE. Three CVEs were published together for this camera on 9 January 2024, so the device should be treated as a group problem, not three separate tickets.

Quick check

Sources

Researcher write up referenced by NVD (TRENDnet_vul.pdf), not retrievable when this post was prepared

Last reviewed: 19 October 2026.