CVE-2017-9829

2017-06-2322:00:00

mitre

www.cve.org

cve-2017-9829

web service

remote attackers

file access

linux filesystem

http request

vivotek network camera

firmware

AI Score

7.4

Confidence

High

EPSS

0.276

Percentile

96.9%

JSON

‘/cgi-bin/admin/downloadMedias.cgi’ of the web service in most of the VIVOTEK Network Cameras is vulnerable, which allows remote attackers to read any file on the camera’s Linux filesystem via a crafted HTTP request containing “…” sequences. This vulnerability is already verified on VIVOTEK Network Camera IB8369/FD8164/FD816BA; most others have similar firmware that may be affected.