CVE-2017-2833

🗓️ 24 Apr 2018 19:00:00Reported by talosType

cve🔗 web.nvd.nist.gov📰️ 2 Media mentions👁 67 Views🌐 WEB

Command injection vulnerability in Foscam C1 Indoor HD Camera firmware 2.52.2.37

Reporter	Title	Published	Views	Family All 9
CNVD	Foscam C1 Indoor HD Camera Command Injection Vulnerability (CNVD-2018-10136)	26 Apr 201800:00	–	cnvd
Cvelist	CVE-2017-2833	24 Apr 201819:00	–	cvelist
EUVD	EUVD-2017-11974	7 Oct 202500:30	–	euvd
NVD	CVE-2017-2833	24 Apr 201819:29	–	nvd
OSV	CVE-2017-2833	24 Apr 201819:29	–	osv
Prion	Command injection	24 Apr 201819:29	–	prion
seebug.org	Foscam IP Video Camera CGIProxy.fcgi FTP Startup Configuration Command Injection Vulnerability(CVE-2017-2833)	15 Sep 201700:00	–	seebug
Talos	Foscam IP Video Camera CGIProxy.fcgi FTP Startup Configuration Command Injection Vulnerability	19 Jun 201700:00	–	talos
Talos Blog	Vulnerability Spotlight: Multiple Foscam C1 Vulnerabilities Come in to Focus	19 Jun 201708:45	–	talosblog

NVD

Vulners

Node

AND

foscam c1_firmwareMatch2.52.2.37

foscam c1Match-

[
  {
    "product": "Indoor IP Camera",
    "vendor": "Foscam",
    "versions": [
      {
        "status": "affected",
        "version": "C1 Series"
      }
    ]
  }
]

Source	Link
securityfocus	www.securityfocus.com/bid/99184
talosintelligence	www.talosintelligence.com/vulnerability_reports/TALOS-2017-0334

Parameter	Position	Path	Description	CWE
usr	query param	cgi-bin/CGIProxy.fcgi	Command injection through boot-time execution via crafted changePassword data in CGIProxy request.	CWE-78
pwd	query param	cgi-bin/CGIProxy.fcgi	Command injection through boot-time execution via crafted changePassword data in CGIProxy request.	CWE-78
cmd	query param	cgi-bin/CGIProxy.fcgi	Command injection through boot-time execution via crafted changePassword data in CGIProxy request.	CWE-78
usrName	query param	cgi-bin/CGIProxy.fcgi	Command injection through boot-time execution via crafted changePassword data in CGIProxy request.	CWE-78
oldPwd	query param	cgi-bin/CGIProxy.fcgi	Command injection through boot-time execution via crafted changePassword data in CGIProxy request.	CWE-78
newPwd	query param	cgi-bin/CGIProxy.fcgi	Command injection through boot-time execution via crafted changePassword data in CGIProxy request.	CWE-78