A structured exception handling buffer overflow in iSmartViewPro 1.5 allows local attackers to execute arbitrary code with application privileges.

The application is susceptible to a classic buffer overflow (CWE-120) triggered when a user inputs a payload exceeding 260 bytes into the Save Path for Snapshot and Record file field. The vulnerability is locally exploitable by an unauthenticated user with access to the application interface.

Successful exploitation allows an attacker to gain control over the application execution flow, potentially leading to arbitrary code execution with the privileges of the software. Given the CVSS score of 8.4, this vulnerability poses a significant risk to the integrity and availability of the host system. If this software is used in critical surveillance environments, a compromise could result in unauthorized access to sensitive video data or complete system takeover.

Immediate Action: There is no official vendor patch available for this legacy software; organizations should discontinue the use of iSmartViewPro 1.5 or isolate the host system from untrusted users.

Proactive Monitoring: Monitor system logs for unexpected application crashes or anomalous process behavior originating from the iSmartViewPro executable.

Compensating Controls: Restrict physical and logical access to the host machine to prevent unauthorized users from interacting with the System Setup interface.

Public Exploit Available: Yes, a functional exploit targeting this vulnerability is available via ExploitDB (EDB-ID: 45349).

Due to the lack of vendor support and the availability of a public exploit, the risk associated with this vulnerability is severe. Organizations must prioritize the migration to a supported and secure surveillance solution, as patching is not a viable path for this legacy software.