CVE-2017-2877

🗓️ 19 Sep 2018 18:00:00Reported by talosType

cve🔗 web.nvd.nist.gov👁 67 Views🌐 WEB

A missing error check in Multi-Camera interface in Foscam C1 Indoor HD Camera 2.52.2.43 firmware allows attacker to reset user accounts without authentication

Reporter	Title	Published	Views	Family All 8
CNVD	Foscam IP Video Camera Reset Factory Settings Vulnerability	15 Nov 201700:00	–	cnvd
Cvelist	CVE-2017-2877	19 Sep 201818:00	–	cvelist
EUVD	EUVD-2017-12018	7 Oct 202500:30	–	euvd
NVD	CVE-2017-2877	19 Sep 201818:29	–	nvd
Prion	Authentication flaw	19 Sep 201818:29	–	prion
seebug.org	Foscam IP Video Camera devMng Multi-Camera Port 10001 Command 0x0064 Empty AuthResetKey Vulnerability(CVE-2017-2877)	14 Nov 201700:00	–	seebug
Talos	Foscam IP Video Camera devMng Multi-Camera Port 10001 Command 0x0064 Empty AuthResetKey Vulnerability	13 Nov 201700:00	–	talos
Talos Blog	Vulnerability Spotlight: Multiple Vulnerabilities in Foscam C1 Indoor HD Cameras	13 Nov 201707:43	–	talosblog

NVD

Vulners

Node

foscam c1_firmwareMatch2.52.2.43

AND

foscam c1Match-

[
  {
    "product": "Foscam C1 Indoor HD Camera",
    "vendor": "Foscam",
    "versions": [
      {
        "status": "affected",
        "version": "Foscam Indoor IP Camera C1 Series,System Firmware Version: 1.9.3.18,Application Firmware Version: 2.52.2.43,Plug-In Version: 3.3.0.26"
      }
    ]
  }
]

Source	Link
talosintelligence	www.talosintelligence.com/vulnerability_reports/TALOS-2017-0384

Parameter	Position	Path	Description	CWE
authResetKey	binary	10001	Missing error handling enables unauthorized reset of user accounts via UDP multicamera interface on port 10001 with command 0x0064.	CWE-755

21 Nov 2024 03:24Current

9.2High risk

Vulners AI Score9.2

CVSS 27.5

CVSS 3.19.8

CVSS 39.8

EPSS0.00467

CWE-755

foscam c1 indoor hd camera firmware authentication vulnerability cve-2017-2877