CVE-2024-0778 is a high severity (CVSS 8.0) OS command injection in the Uniview ISC 2500-S, in the setNatConfig function of /Interface/DevManage/VM.php, for firmware up to 20210930. The vendor says the product is end of life, so no patch is expected. Retire and replace the device.
What's affected
Uniview ISC 2500-S firmware up to 20210930. The vulnerable code is the setNatConfig function in /Interface/DevManage/VM.php, and the arguments natAddress, natPort and natServerPort reach an operating system command.
The description is marked unsupported when assigned. It says the vendor confirmed immediately that the product is end of life and that it should be retired and replaced. No fixed version exists to name.
The record classifies the weakness as CWE-78 (OS command injection). NVD scores it 8.0 (High) with the vector CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H.
The sources differ on severity. The description calls the issue critical, while NVD's CVSS 3.1 score is 8.0 (High). The record also says an exploit has been disclosed to the public, which raises urgency for any exposed unit regardless of the label.
How to check if you're exposed
There is no package manager command that answers this one, because the record points to a standalone application or a product that publishes no version history. Start with an inventory question: do you run Uniview ISC 2500-S anywhere, including test servers, lab machines and forgotten demo installs?
If you build software from source, search your repositories and artifact stores for the project name. The free in-browser dependency scan can flag known issues in the dependencies it finds, which helps when the component is vendored or pulled in transitively.
What to do now
- Inventory every Uniview ISC 2500-S, checking the device label and the firmware page.
- Take any unit that is reachable from the internet offline now, or put it behind a VPN or firewall rule that blocks outside access.
- Segment remaining units onto a restricted network and block management access except from a small set of admin hosts.
- Plan replacement with a supported product and budget it, since the vendor will not issue a fix.
Why it matters
Command injection (CWE-78) happens when user supplied input is placed into a shell command without being neutralised. On an embedded device the web interface often runs with full privileges, so injection can mean control of the whole device.
End of life products are the hard case, because the only durable fix is to remove them. The mitigations above reduce exposure while the replacement is arranged.
The record does not mark this CVE as being in the CISA Known Exploited Vulnerabilities catalog, and nothing in the record says it is exploited in the wild. That can change, so keep it on your watch list.
Quick check
Is there a patch?
No. The record says the vendor confirmed the product is end of life and that it should be retired and replaced.
Sources
The links below are the references listed in the CVE record. The record and its description were the basis for this post, and the vendor advisory remains the authority for fixed versions.
Last reviewed: 19 October 2026.
