CVE-2017-2847

🗓️ 29 Jun 2017 17:00:00Reported by talosType

cve🔗 web.nvd.nist.gov👁 58 Views🌐 WEB

Foscam C1 Indoor HD cameras with application firmware 2.52.2.37 HTTP Request Command Injectio

Reporter	Title	Published	Views	Family All 9
CNVD	Foscam C1 Indoor HD Camera cgiproxy.fcgi -DNS1.address configuration command injection vulnerability	3 Jul 201700:00	–	cnvd
Cvelist	CVE-2017-2847	29 Jun 201717:00	–	cvelist
EUVD	EUVD-2017-11988	7 Oct 202500:30	–	euvd
NVD	CVE-2017-2847	29 Jun 201717:29	–	nvd
Prion	Command injection	29 Jun 201717:29	–	prion
seebug.org	Foscam IP Video Camera Command Injection Vulnerability(CVE-2017-2847)	4 Jul 201700:00	–	seebug
seebug.org	Foscam IP Video Camera CGIProxy.fcgi DNS1 Address Configuration Command Injection Vulnerability(CVE-2017-2847)	15 Sep 201700:00	–	seebug
Talos	Foscam IP Video Camera CGIProxy.fcgi DNS1 Address Configuration Command Injection Vulnerability	19 Jun 201700:00	–	talos
Talos Blog	Vulnerability Spotlight: Multiple Foscam C1 Vulnerabilities Come in to Focus	19 Jun 201708:45	–	talosblog

NVD

Node

foscam c1_indoor_hd_camera_firmwareMatch2.52.2.37

AND

foscam c1_indoor_hd_cameraMatch-

[
  {
    "product": "Indoor IP Camera C1 Series",
    "vendor": "Foscam",
    "versions": [
      {
        "status": "affected",
        "version": "n/a"
      }
    ]
  }
]

Source	Link
talosintelligence	www.talosintelligence.com/vulnerability_reports/TALOS-2017-0349
securityfocus	www.securityfocus.com/bid/99184

Parameter	Position	Path	Description	CWE
usr	query param	cgi-bin/CGIProxy.fcgi	OS command injection via CGIProxy.fcgi when handling setIpInfo; user-supplied parameters are not sanitized, allowing arbitrary shell commands to be executed through the network configuration flow.	CWE-78
pwd	query param	cgi-bin/CGIProxy.fcgi	OS command injection via CGIProxy.fcgi when handling setIpInfo; user-supplied parameters are not sanitized, allowing arbitrary shell commands to be executed through the network configuration flow.	CWE-78
cmd	query param	cgi-bin/CGIProxy.fcgi	OS command injection via CGIProxy.fcgi when handling setIpInfo; user-supplied parameters are not sanitized, allowing arbitrary shell commands to be executed through the network configuration flow.	CWE-78
isDHCP	query param	cgi-bin/CGIProxy.fcgi	OS command injection via CGIProxy.fcgi when handling setIpInfo; user-supplied parameters are not sanitized, allowing arbitrary shell commands to be executed through the network configuration flow.	CWE-78
ip	query param	cgi-bin/CGIProxy.fcgi	OS command injection via CGIProxy.fcgi when handling setIpInfo; user-supplied parameters are not sanitized, allowing arbitrary shell commands to be executed through the network configuration flow.	CWE-78
mask	query param	cgi-bin/CGIProxy.fcgi	OS command injection via CGIProxy.fcgi when handling setIpInfo; user-supplied parameters are not sanitized, allowing arbitrary shell commands to be executed through the network configuration flow.	CWE-78
gate	query param	cgi-bin/CGIProxy.fcgi	OS command injection via CGIProxy.fcgi when handling setIpInfo; user-supplied parameters are not sanitized, allowing arbitrary shell commands to be executed through the network configuration flow.	CWE-78
dns1	query param	cgi-bin/CGIProxy.fcgi	OS command injection via CGIProxy.fcgi when handling setIpInfo; user-supplied parameters are not sanitized, allowing arbitrary shell commands to be executed through the network configuration flow.	CWE-78
dns2	query param	cgi-bin/CGIProxy.fcgi	OS command injection via CGIProxy.fcgi when handling setIpInfo; user-supplied parameters are not sanitized, allowing arbitrary shell commands to be executed through the network configuration flow.	CWE-78

13 May 2026 00:24Current

8.8High risk

Vulners AI Score8.8

CVSS 26.5

CVSS 3.18.8

CVSS 38.8

EPSS0.02198

CWE-78

foscam c1 indoor hd cameras firmware vulnerability http request command injection cve-2017-2847 nvd