Critical severity · published Nov 22, 2021
CVE-2021-26614
ius_get.cgi in IpTime C200 camera allows remote code execution
9.8
CVSS
2.5%
EPSS
No
On KEV
Description
ius_get.cgi in IpTime C200 camera allows remote code execution. A remote attacker may send a crafted parameters to the exposed vulnerable web service interface which invokes the arbitrary shell command.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)2.5% · higher than 85% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CF
C200 Firmware · Iptime
before 1.060 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2021-26614
CVE.org
https://www.cve.org/CVERecord?id=CVE-2021-26614
Third Party Advisory
https://www.boho.or.kr/krcert/secNoticeView.do?bulletin_writing_sequence=36346
More from C200 Firmware
9.8
CVE-2020-7879
This issue was discovered when the ipTIME C200 IP Camera was synchronized with the ipTIME NAS
8.0
CVE-2020-7848
The EFM ipTIME C200 IP Camera is affected by a Command Injection vulnerability in /login.cgi?logout=1 script