Login Request a demo
High severity · published Apr 24, 2018
CVE-2017-2833
An exploitable command injection vulnerability exists in the web management interface used by the Foscam C1 Indoor HD Camera running application firmware 2.52.2.37
7.5
CVSS
4.7%
EPSS
No
On KEV
Description
An exploitable command injection vulnerability exists in the web management interface used by the Foscam C1 Indoor HD Camera running application firmware 2.52.2.37. A specially crafted HTTP request can allow for a user to inject arbitrary shell characters resulting in command injection during the boot process. To trigger this vulnerability, an attacker needs to send an HTTP request and reboot the device.
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
High
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)4.7% · higher than 92% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CF
C1 Firmware · Foscam
2.52.2.37 · source: NVD
Affected product
CF
C1 Firmware
Foscam
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2017-2833
CVE.org
https://www.cve.org/CVERecord?id=CVE-2017-2833
Broken Link
http://www.securityfocus.com/bid/99184
Exploit
https://www.talosintelligence.com/vulnerability_reports/TALOS-2017-0334
More from C1 Firmware
9.8
CVE-2017-2877
A missing error check exists in the Multi-Camera interface used by the Foscam C1 Indoor HD Camera running application firmware 2.52.2.43
9.1
CVE-2017-2875
An exploitable buffer overflow vulnerability exists in the Multi-Camera interface used by the Foscam C1 Indoor HD Camera running application firmware 2.52.2.43
8.8
CVE-2017-2871
Insufficient security checks exist in the recovery procedure used by the Foscam C1 Indoor HD Camera running application firmware 2.52.2.43
8.1
CVE-2017-2855
An exploitable buffer overflow vulnerability exists in the DDNS client used by the Foscam C1 Indoor HD Camera running application firmware 2.52.2.43
8.1
CVE-2017-2857
An exploitable buffer overflow vulnerability exists in the DDNS client used by the Foscam C1 Indoor HD Camera running application firmware 2.52.2.43