CVE-2017-18377: Improper Neutralization of Special Elements used in a Command

An issue was discovered on Wireless IP Camera P2P WIFICAM cameras. There is Command Injection in the setftp.cgi script via shell metacharacters in the pwd variable, as demonstrated by a setftp.cgi?svr=192.168.1.1&port=21&user=ftp URI...

CVE-2017-8225: Insufficiently Protected Credentials

On Wireless IP Camera P2P WIFICAM devices, access to .ini files containing credentials is not correctly checked. An attacker can bypass authentication by providing an empty loginuse parameter and an empty loginpas parameter in the URI...

PT-2017-18225

Name of the Vulnerable Software and Affected Versions Wireless IP Camera P2P WIFICAM devices affected versions not specified Description The issue concerns the storage of an "Apple Production IOS Push Services" private RSA key and certificate in the firmware of the devices, specifically in the...

CVE-2017-8222: Insufficiently Protected Credentials

Wireless IP Camera P2P WIFICAM devices have an "Apple Production IOS Push Services" private RSA key and certificate stored in /system/www/pem/ck.pem inside the firmware, which allows attackers to obtain sensitive information...

CVE-2017-8224: Use of Hard-coded Credentials

Wireless IP Camera P2P WIFICAM devices have a backdoor root account that can be accessed with TELNET...

PT-2017-18226

Name of the Vulnerable Software and Affected Versions Wireless IP Camera P2P WIFICAM devices affected versions not specified Description The issue allows an attacker to watch the streaming without authentication via the RTSP server on port 10554/tcp, specifically through tcp/av0 1 or tcp/av0 0...

PT-2017-18227

Name of the Vulnerable Software and Affected Versions Wireless IP Camera P2P WIFICAM devices affected versions not specified Description The issue concerns incorrect access control to .ini files, which contain credentials. An attacker can bypass authentication by manipulating the loginuse and...

CVE-2017-8221: Missing Encryption of Sensitive Data

Wireless IP Camera P2P WIFICAM devices rely on a cleartext UDP tunnel protocol aka the Cloud feature for communication between an Android application and a camera device, which allows remote attackers to obtain sensitive information by sniffing the network...

PT-2017-18224

Name of the Vulnerable Software and Affected Versions Wireless IP Camera P2P WIFICAM devices affected versions not specified Description The issue concerns the use of a cleartext UDP tunnel protocol, also known as the Cloud feature, for communication between an Android application and a camera...

CVE-2017-8223: Improper Authentication

On Wireless IP Camera P2P WIFICAM devices, an attacker can use the RTSP server on port 10554/tcp to watch the streaming without authentication via tcp/av01 or tcp/av00...