480 matches found
CVE-2017-2848
The CVE-2017-2848 issue affects Foscam C1 Indoor HD Cameras (CGIProxy.fcgi). A crafted setIpInfo request can inject arbitrary OS commands via the DNS2 parameter (and other networking fields). The exploit path involves feeding unvalidated input into shell commands (e.g., dns2 + attacker-controlled...
CVE-2017-2849
CVE-2017-2849 affects Foscam C1 Indoor HD Camera (application firmware 2.52.2.37). The web CGI interface (CGIProxy.fcgi) passes ntpServer from the user query to a shell via popen without proper sanitization, enabling command injection through a crafted NTP server value. The exploit can be deliver...
CVE-2017-2845
Summary: CVE-2017-2845 is a command-injection flaw in Foscam C1 C1 Indoor HD Camera’s CGIProxy.fcgi SMTP Test path. An attacker with admin access can craft an SMTP Test request (smtpTest) to inject OS commands via the SMTP host parameter, potentially achieving code execution. Affected firmware: 2...
CVE-2017-2848
In the web management interface in Foscam C1 Indoor HD cameras with application firmware 2.52.2.37, a specially crafted HTTP request can allow for a user to inject arbitrary shell characters during manual network configuration resulting in command injection. An attacker can simply send an HTTP...
CVE-2017-2850
In the web management interface in Foscam C1 Indoor HD cameras with application firmware 2.52.2.37, a specially crafted HTTP request can allow for a user to inject arbitrary characters in the pureftpd.passwd file during a username change, which in turn allows for bypassing chroot restrictions in...
CVE-2017-2851
CVE-2017-2851 affects the Foscam C1 Indoor HD Camera web CGIProxy.fcgi. A buffer overflow in setWifiSetting is caused by unbounded copying of the comma-separated psk string into a 0x100-sized buffer, enabling an attacker with admin access (privilege 2) to overwrite saved registers (e.g., R4) and ...
Design/Logic Flaw
In the web management interface in Foscam C1 Indoor HD Camera running application firmware 2.52.2.37, a specially crafted HTTP request can allow for a user to inject arbitrary data in the "msmtprc" configuration file resulting in command execution. An attacker can simply send an HTTP request to t...
Command injection
An exploitable command injection vulnerability exists in the web management interface used by the Foscam C1 Indoor HD Camera running application firmware 2.52.2.37. A specially crafted HTTP request can allow for a user to inject arbitrary data in the "msmtprc" configuration file resulting in...
Design/Logic Flaw
In the web management interface in Foscam C1 Indoor HD Camera running application firmware 2.52.2.37, a specially crafted HTTP request can allow for a user to inject arbitrary data in the "msmtprc" configuration file resulting in command execution. An attacker can simply send an HTTP request to t...
CVE-2017-2842
In the web management interface in Foscam C1 Indoor HD Camera running application firmware 2.52.2.37, a specially crafted HTTP request can allow for a user to inject arbitrary data in the "msmtprc" configuration file resulting in command execution. An attacker can simply send an HTTP request to t...
CVE-2017-2841
An exploitable command injection vulnerability exists in the web management interface used by the Foscam C1 Indoor HD Camera running application firmware 2.52.2.37. A specially crafted HTTP request can allow for a user to inject arbitrary data in the "msmtprc" configuration file resulting in...
CVE-2017-2841
An exploitable command injection vulnerability exists in the web management interface used by the Foscam C1 Indoor HD Camera running application firmware 2.52.2.37. A specially crafted HTTP request can allow for a user to inject arbitrary data in the "msmtprc" configuration file resulting in...
CVE-2017-2842
In the web management interface in Foscam C1 Indoor HD Camera running application firmware 2.52.2.37, a specially crafted HTTP request can allow for a user to inject arbitrary data in the "msmtprc" configuration file resulting in command execution. An attacker can simply send an HTTP request to t...
CVE-2017-2843
In the web management interface in Foscam C1 Indoor HD Camera running application firmware 2.52.2.37, a specially crafted HTTP request can allow for a user to inject arbitrary data in the "msmtprc" configuration file resulting in command execution. An attacker can simply send an HTTP request to t...
CVE-2017-2841
The CVE-2017-2841 issue affects Foscam C1 Indoor HD Camera (firmware 2.52.2.37). A command-injection flaw exists in CGIProxy.fcgi via the SMTP Test parameter (smtpTest), which writes unsanitized data into the msmtprc config and can trigger arbitrary OS commands. The chain enables code execution t...
CVE-2017-2843
The CVE-2017-2843 issue affects Foscam C1 Indoor HD Camera (application firmware 2.52.2.37) via CGIProxy.fcgi. A crafted HTTP request to smtpTest allows injection into the msmtprc configuration, enabling command execution on the device. The exploit path traverses CGIProxy.fcgi -> SMTP Test Hos...
CVE-2017-2842
In the web management interface in Foscam C1 Indoor HD Camera running application firmware 2.52.2.37, a specially crafted HTTP request can allow for a user to inject arbitrary data in the "msmtprc" configuration file resulting in command execution. An attacker can simply send an HTTP request to t...
CVE-2017-2841
An exploitable command injection vulnerability exists in the web management interface used by the Foscam C1 Indoor HD Camera running application firmware 2.52.2.37. A specially crafted HTTP request can allow for a user to inject arbitrary data in the "msmtprc" configuration file resulting in...
CVE-2017-2842
The CVE-2017-2842 issue affects Foscam C1 Indoor HD Camera (firmware 2.52.2.37) via CGIProxy.fcgi. A crafted smtpTest request lets an attacker inject data into msmtprc, enabling command execution (via passwordeval). PoC shows admin-authenticated remote trigger; exploit leverages injection in SMTP...
