Vulnerability Spotlight: Multiple Vulnerabilities in Foscam C1 Indoor HD Cameras

These vulnerabilities were discovered by Claudio Bozzato of Cisco Talos.Executive SummaryThe Foscam C1 Indoor HD Camera is a network-based camera that is marketed for use in a variety of applications, including use as a home security monitoring device. Talos recently identified several...

PT-2017-15578

Name of the Vulnerable Software and Affected Versions Foscam C1 Indoor HD cameras version 2.52.2.37 Description A command injection issue exists in the web management interface of the affected device. This occurs when a specially crafted HTTP request is sent, allowing an attacker to inject...

PT-2017-15579

Name of the Vulnerable Software and Affected Versions Foscam C1 Indoor HD cameras version 2.52.2.37 Description A command injection issue exists in the web management interface of the affected device. This occurs when a specially crafted HTTP request is sent, allowing an attacker to inject...

PT-2017-15582

Name of the Vulnerable Software and Affected Versions Foscam C1 Indoor HD cameras version 2.52.2.37 Description A specially crafted HTTP request can allow a user to inject arbitrary characters in the pureftpd.passwd file during a username change, which in turn allows for bypassing chroot...

CVE-2017-2844: Improper Neutralization of Special Elements used in an OS Command

In the web management interface in Foscam C1 Indoor HD cameras with application firmware 2.52.2.37, a specially crafted HTTP request can allow for a user to inject arbitrary data in the "msmtprc" configuration file resulting in command execution. An attacker can simply send an HTTP request to the...

PT-2017-15583

Name of the Vulnerable Software and Affected Versions Foscam C1 Indoor HD cameras version 2.52.2.37 Description A buffer overflow can occur in the web management interface of the affected cameras due to a specially crafted HTTP request. Recommendations For version 2.52.2.37, update the applicatio...

PT-2017-15576

Name of the Vulnerable Software and Affected Versions Foscam C1 Indoor HD cameras version 2.52.2.37 Description A specially crafted HTTP request to the web management interface can allow a user to inject arbitrary data in the msmtprc configuration file, resulting in command execution. An attacker...

PT-2017-15580

Name of the Vulnerable Software and Affected Versions Foscam C1 Indoor HD cameras version 2.52.2.37 Description A command injection issue exists in the web management interface, allowing an attacker to inject arbitrary shell characters during manual network configuration via a specially crafted...