CVE-2017-2830

Foscam C1 Indoor HD Camera is affected by a stack-based buffer overflow in the CGIProxy.fcgi web service. The flaw occurs while parsing multipart/form-data during a POST (usrBeatHeart/0x3001 flow); a boundary string larger than 0x100 bytes overflows a stack buffer, enabling potential code executi...

CVE-2017-2805

An exploitable stack-based buffer overflow vulnerability exists in the web management interface used by the Foscam C1 Indoor HD Camera. A specially crafted http request can cause a stack-based buffer overflow resulting in overwriting arbitrary data on the stack frame. An attacker can simply send ...

CVE-2017-2829

Summary (CVE-2017-2829) : Cisco Talos and security trackers document a directory traversal vulnerability in the Foscam C1 Indoor HD Camera’s web management interface via the CGIProxy.fcgi service. An unauthenticated or authenticated user can craft a request that triggers the 0x3001 “Message” path...

CVE-2017-2827

The CVE-2017-2827 issue affects Foscam C1 Indoor HD Cameras via the CGIProxy.fcgi service in the web management interface. An account creation command (addAccount) accepts usrName, usrPwd, and privilege (required to be 2) and passes these to FTPconfigUser, which builds a shell command: sh /usr/bi...

CVE-2017-2805

The CVE-2017-2805 issue affects Foscam C1 Indoor HD Camera via the webService CGIProxy.fcgi. A stack-based buffer overflow is triggered by processing HTTP requests that carry parameters (usr, pwd, cmd). Each parameter buffer is 0x40 bytes; overflowing usr/pwd/cmd can overwrite adjacent stack data...

CVE-2017-2828

An exploitable command injection vulnerability exists in the web management interface used by the Foscam C1 Indoor HD Camera running application firmware 2.52.2.37. A specially crafted HTTP request can allow for a user to inject arbitrary shell characters during account creation resulting in...

CVE-2017-2827

An exploitable command injection vulnerability exists in the web management interface used by the Foscam C1 Indoor HD Camera running application firmware 2.52.2.37. A specially crafted HTTP request can allow for a user to inject arbitrary shell characters during account creation resulting in...

CVE-2017-2828

CVE-2017-2828 affects Foscam C1 Indoor HD Camera via CGIProxy.fcgi (web management) where changePassword allows command injection. The vulnerability stems from processing of the newPwd parameter: after validating user exists and that the old password matches, the code builds a shell command strin...

CVE-2017-2831

CVE-2017-2831 affects Foscam C1 Indoor HD Camera (firmware 2.52.2.37). The CGIProxy.fcgi web interface contains a stack-based buffer overflow: the query string is decoded and copied into a 0x400-byte buffer, then concatenated with REMOTE_ADDR and optional remoteP2P data, which writes beyond the b...

CVE-2017-2828: Improper Neutralization of Special Elements used in an OS Command

An exploitable command injection vulnerability exists in the web management interface used by the Foscam C1 Indoor HD Camera running application firmware 2.52.2.37. A specially crafted HTTP request can allow for a user to inject arbitrary shell characters during account creation resulting in...

CVE-2017-2829: Improper Limitation of a Pathname to a Restricted Directory

An exploitable directory traversal vulnerability exists in the web management interface used by the Foscam C1 Indoor HD Camera running application firmware 2.52.2.37. A specially crafted HTTP request can cause the application to read a file from disk but a failure to adequately filter characters...

CVE-2017-2831: Buffer Copy without Checking Size of Input

An exploitable buffer overflow vulnerability exists in the web management interface used by the Foscam C1 Indoor HD Camera running application firmware 2.52.2.37. A specially crafted HTTP request can cause a buffer overflow resulting in overwriting arbitrary data. An attacker can simply send an...

PT-2017-15547 · Foscam · Foscam C1 Indoor Hd Camera

Name of the Vulnerable Software and Affected Versions: Foscam C1 Indoor HD Camera affected versions not specified Description: A stack-based buffer overflow issue exists in the web management interface of the affected device. This can be triggered by a specially crafted HTTP request, leading to a...

CVE-2017-2805: Out-of-bounds Write

An exploitable stack-based buffer overflow vulnerability exists in the web management interface used by the Foscam C1 Indoor HD Camera. A specially crafted http request can cause a stack-based buffer overflow resulting in overwriting arbitrary data on the stack frame. An attacker can simply send ...

CVE-2017-2827: Improper Neutralization of Special Elements used in an OS Command

An exploitable command injection vulnerability exists in the web management interface used by the Foscam C1 Indoor HD Camera running application firmware 2.52.2.37. A specially crafted HTTP request can allow for a user to inject arbitrary shell characters during account creation resulting in...

CVE-2017-2830: Buffer Copy without Checking Size of Input

An exploitable buffer overflow vulnerability exists in the web management interface used by the Foscam C1 Indoor HD Camera running application firmware 2.52.2.37. A specially crafted HTTP request can cause a buffer overflow resulting in overwriting arbitrary data. An attacker can simply send an...

Foscam IP Video Camera CGIProxy.fcgi Gateway Address Configuration Command Injection Vulnerability

Summary An exploitable command injection vulnerability exists in the web management interface used by the Foscam C1 Indoor HD Camera running application firmware 2.52.2.37. A specially crafted HTTP request can allow for a user to inject arbitrary shell characters during manual network configurati...

Foscam IP Video Camera CGIProxy.fcgi SMTP Test User Parameter Configuration Command Injection Vulnerability

Summary An exploitable command injection vulnerability exists in the web management interface used by the Foscam C1 Indoor HD Camera running application firmware 2.52.2.37. A specially crafted HTTP request can allow for a user to inject arbitrary data in the “msmtprc” configuration file resulting...

Foscam IP Video Camera CGIProxy.fcgi NTP Server Configuration Command Injection Vulnerability

Summary An exploitable command injection vulnerability exists in the web management interface used by the Foscam C1 Indoor HD Camera running application firmware 2.52.2.37. A specially crafted HTTP request can allow for a user to inject arbitrary shell characters during NTP server configuration...

Foscam IP Video Camera CGIProxy.fcgi DNS1 Address Configuration Command Injection Vulnerability

Summary An exploitable command injection vulnerability exists in the web management interface used by the Foscam C1 Indoor HD Camera running application firmware 2.52.2.37. A specially crafted HTTP request can allow for a user to inject arbitrary shell characters during manual network configurati...