Login Request a demo
High severity · published Jun 29, 2017
CVE-2017-2850
In the web management interface in Foscam C1 Indoor HD cameras with application firmware 2.52.2.37, a specially crafted HTTP request can allow for a user to inject arbitrary…
8.8
CVSS
2.2%
EPSS
No
On KEV
Description
In the web management interface in Foscam C1 Indoor HD cameras with application firmware 2.52.2.37, a specially crafted HTTP request can allow for a user to inject arbitrary characters in the pureftpd.passwd file during a username change, which in turn allows for bypassing chroot restrictions in the FTP server. An attacker can simply send an HTTP request to the device to trigger this vulnerability.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)2.2% · higher than 83% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CI
C1 Indoor HD Camera Firmware · Foscam
2.52.2.37 · source: NVD
Affected product
CI
C1 Indoor HD Camera Firmware
Foscam
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2017-2850
CVE.org
https://www.cve.org/CVERecord?id=CVE-2017-2850
Broken Link
http://www.securityfocus.com/bid/99184
Technical Description
https://talosintelligence.com/vulnerability_reports/TALOS-2017-0352
More from C1 Indoor HD Camera Firmware
8.8
CVE-2017-2849
In the web management interface in Foscam C1 Indoor HD cameras with application firmware 2.52.2.37, a specially crafted HTTP request can allow for a user to inject arbitrary shell…
8.8
CVE-2017-2848
In the web management interface in Foscam C1 Indoor HD cameras with application firmware 2.52.2.37, a specially crafted HTTP request can allow for a user to inject arbitrary shell…
8.8
CVE-2017-2847
In the web management interface in Foscam C1 Indoor HD cameras with application firmware 2.52.2.37, a specially crafted HTTP request can allow for a user to inject arbitrary shell…
8.8
CVE-2017-2846
In the web management interface in Foscam C1 Indoor HD cameras with application firmware 2.52.2.37, a specially crafted HTTP request can allow for a user to inject arbitrary shell…
8.8
CVE-2017-2845
An exploitable command injection vulnerability exists in the web management interface used by the Foscam C1 Indoor HD Camera running application firmware 2.52.2.37