Login Request a demo
High severity · published Jun 29, 2017
CVE-2017-2846
In the web management interface in Foscam C1 Indoor HD cameras with application firmware 2.52.2.37, a specially crafted HTTP request can allow for a user to inject arbitrary shell…
8.8
CVSS
4.1%
EPSS
No
On KEV
Description
In the web management interface in Foscam C1 Indoor HD cameras with application firmware 2.52.2.37, a specially crafted HTTP request can allow for a user to inject arbitrary shell characters during manual network configuration resulting in command injection. An attacker can simply send an HTTP request to the device to trigger this vulnerability.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)4.1% · higher than 91% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CI
C1 Indoor HD Camera Firmware · Foscam
2.52.2.37 · source: NVD
Affected product
CI
C1 Indoor HD Camera Firmware
Foscam
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2017-2846
CVE.org
https://www.cve.org/CVERecord?id=CVE-2017-2846
Broken Link
http://www.securityfocus.com/bid/99184
Technical Description
https://talosintelligence.com/vulnerability_reports/TALOS-2017-0348
More from C1 Indoor HD Camera Firmware
8.8
CVE-2017-2850
In the web management interface in Foscam C1 Indoor HD cameras with application firmware 2.52.2.37, a specially crafted HTTP request can allow for a user to inject arbitrary…
8.8
CVE-2017-2849
In the web management interface in Foscam C1 Indoor HD cameras with application firmware 2.52.2.37, a specially crafted HTTP request can allow for a user to inject arbitrary shell…
8.8
CVE-2017-2848
In the web management interface in Foscam C1 Indoor HD cameras with application firmware 2.52.2.37, a specially crafted HTTP request can allow for a user to inject arbitrary shell…
8.8
CVE-2017-2847
In the web management interface in Foscam C1 Indoor HD cameras with application firmware 2.52.2.37, a specially crafted HTTP request can allow for a user to inject arbitrary shell…
8.8
CVE-2017-2845
An exploitable command injection vulnerability exists in the web management interface used by the Foscam C1 Indoor HD Camera running application firmware 2.52.2.37