CVE-2017-2851

In the web management interface in Foscam C1 Indoor HD cameras with application firmware 2.52.2.37, a specially crafted HTTP request can cause a buffer overflow...

CVE-2017-2844

Summary (CVE-2017-2844) : The Foscam C1 Indoor HD Camera web management CGIProxy.fcgi is vulnerable to a command-injection via the SMTP test flow. An authenticated administrator can inject data into the msmtprc configuration by sending a crafted HTTP request through the smtpTest command, leading ...

CVE-2017-2845

Summary: CVE-2017-2845 is a command-injection flaw in Foscam C1 C1 Indoor HD Camera’s CGIProxy.fcgi SMTP Test path. An attacker with admin access can craft an SMTP Test request (smtpTest) to inject OS commands via the SMTP host parameter, potentially achieving code execution. Affected firmware: 2...

CVE-2017-2848

The CVE-2017-2848 issue affects Foscam C1 Indoor HD Cameras (CGIProxy.fcgi). A crafted setIpInfo request can inject arbitrary OS commands via the DNS2 parameter (and other networking fields). The exploit path involves feeding unvalidated input into shell commands (e.g., dns2 + attacker-controlled...

CVE-2017-2849

CVE-2017-2849 affects Foscam C1 Indoor HD Camera (application firmware 2.52.2.37). The web CGI interface (CGIProxy.fcgi) passes ntpServer from the user query to a shell via popen without proper sanitization, enabling command injection through a crafted NTP server value. The exploit can be deliver...

CVE-2017-2850

Summary (CVE-2017-2850): The Foscam C1 Indoor HD Camera (firmware 2.52.2.37) is affected by a vulnerability in the CGIProxy.fcgi service where the Change Username operation can inject arbitrary characters into the pureftpd.passwd file. This bypasses FTP chroot and enables privilege escalation via...

CVE-2017-2851

CVE-2017-2851 affects the Foscam C1 Indoor HD Camera web CGIProxy.fcgi. A buffer overflow in setWifiSetting is caused by unbounded copying of the comma-separated psk string into a 0x100-sized buffer, enabling an attacker with admin access (privilege 2) to overwrite saved registers (e.g., R4) and ...

CVE-2017-2847

CVE-2017-2847 affects Foscam C1 Indoor HD Cameras via the web management CGIProxy.fcgi service. The vulnerability allows command injection through the CGIProxy setIpInfo path when configuring network settings. An attacker with an administrator account can supply crafted input in the DNS1 paramete...

CVE-2017-2846

CVE-2017-2846 affects Foscam C1 Indoor HD Camera (web CGIProxy.fcgi). A command injection is achievable via the setIpInfo input when configuring networking: an attacker with admin access can inject shell commands through gateway/address fields, leading to remote code execution on the device. The ...

CVE-2017-2848

In the web management interface in Foscam C1 Indoor HD cameras with application firmware 2.52.2.37, a specially crafted HTTP request can allow for a user to inject arbitrary shell characters during manual network configuration resulting in command injection. An attacker can simply send an HTTP...

PT-2017-15577

Name of the Vulnerable Software and Affected Versions Foscam C1 Indoor HD Camera version 2.52.2.37 Description An exploitable command injection issue exists in the web management interface. A specially crafted HTTP request can allow a user to inject arbitrary shell characters during the SMTP...

PT-2017-15578

Name of the Vulnerable Software and Affected Versions Foscam C1 Indoor HD cameras version 2.52.2.37 Description A command injection issue exists in the web management interface of the affected device. This occurs when a specially crafted HTTP request is sent, allowing an attacker to inject...

PT-2017-15580

Name of the Vulnerable Software and Affected Versions Foscam C1 Indoor HD cameras version 2.52.2.37 Description A command injection issue exists in the web management interface, allowing an attacker to inject arbitrary shell characters during manual network configuration via a specially crafted...

PT-2017-15582

Name of the Vulnerable Software and Affected Versions Foscam C1 Indoor HD cameras version 2.52.2.37 Description A specially crafted HTTP request can allow a user to inject arbitrary characters in the pureftpd.passwd file during a username change, which in turn allows for bypassing chroot...

PT-2017-15583

Name of the Vulnerable Software and Affected Versions Foscam C1 Indoor HD cameras version 2.52.2.37 Description A buffer overflow can occur in the web management interface of the affected cameras due to a specially crafted HTTP request. Recommendations For version 2.52.2.37, update the applicatio...

PT-2017-15579

Name of the Vulnerable Software and Affected Versions Foscam C1 Indoor HD cameras version 2.52.2.37 Description A command injection issue exists in the web management interface of the affected device. This occurs when a specially crafted HTTP request is sent, allowing an attacker to inject...

PT-2017-15581

Name of the Vulnerable Software and Affected Versions Foscam C1 Indoor HD cameras version 2.52.2.37 Description A command injection issue exists in the web management interface of the affected device. This occurs when a specially crafted HTTP request is sent, allowing an attacker to inject...

CVE-2017-2849: Improper Neutralization of Special Elements used in an OS Command

In the web management interface in Foscam C1 Indoor HD cameras with application firmware 2.52.2.37, a specially crafted HTTP request can allow for a user to inject arbitrary shell characters during NTP server configuration resulting in command injection. An attacker can simply send an HTTP reques...

CVE-2017-2846: Improper Neutralization of Special Elements used in an OS Command

In the web management interface in Foscam C1 Indoor HD cameras with application firmware 2.52.2.37, a specially crafted HTTP request can allow for a user to inject arbitrary shell characters during manual network configuration resulting in command injection. An attacker can simply send an HTTP...

PT-2017-15576

Name of the Vulnerable Software and Affected Versions Foscam C1 Indoor HD cameras version 2.52.2.37 Description A specially crafted HTTP request to the web management interface can allow a user to inject arbitrary data in the msmtprc configuration file, resulting in command execution. An attacker...