Privilege Escalation Vulnerability in Alaga Home Security WiFi Camera

The Alaga Home Security WiFi Camera 3K (model S-CW2503C-H) is vulnerable to privilege escalation. Other models from the same vendor are likely affected as they appear to share the same firmware.
We‘ve reported the vulnerability to the vendor multiple times; they did not respond. The devices therefore likely remain unpatched.

Local Privilege Escalation (CVE-2025-55810)

Description

The Alaga Home Security WiFi Camera 3K (model S-CW2503C-H) is vulnerable to privilege escalation.
The /etc/init.sh script contains several so-called 'hooking' queries, that probe the SD card for specific files. If a matching file is found, the script executes it as root early in the boot sequence.

Example:

During boot, the script verifies the presence of /mnt/sdcard/XC_${SYS_NAME}/HOOK.sh on the memory card (where SYS_NAME is the model name) and, if the file exists, runs it with root privileges.