CVE-2018-19073

The CVE-2018-19073 entry describes arbitrary OS command execution on Foscam C2 (System 1.11.1.8; App 2.72.1.32) and Opticam i5 (System 1.5.2.11; App 2.21.1.128) devices. Vulnerability arises from allowing shell metacharacters in the modelName by exploiting write access to /mnt/mtd/app/config/Prod...

CVE-2018-19076

An issue was discovered on Foscam C2 devices with System Firmware 1.11.1.8 and Application Firmware 2.72.1.32, and Opticam i5 devices with System Firmware 1.5.2.11 and Application Firmware 2.21.1.128. The FTP and RTSP services make it easier for attackers to conduct brute-force authentication...

CVE-2018-19074

The CVE-2018-19074 entry concerns Foscam C2 devices (System Firmware 1.11.1.8; App FW 2.72.1.32) and Opticam i5 devices (System FW 1.5.2.11; App FW 2.21.1.128). The underlying issue is that the firewall provides minimal protection: it blocks only port 443 and partially blocks port 88, leaving oth...

CVE-2018-19072

An issue was discovered on Foscam C2 devices with System Firmware 1.11.1.8 and Application Firmware 2.72.1.32, and Opticam i5 devices with System Firmware 1.5.2.11 and Application Firmware 2.21.1.128. /mnt/mtd/app has 0777 permissions, allowing local users to replace an archive file within that...

CVE-2018-19072

The CVE-2018-19072 entry affects Foscam C2 devices (System Firmware 1.11.1.8 and Application Firmware 2.72.1.32) and Opticam i5 devices (System Firmware 1.5.2.11 and Application Firmware 2.21.1.128). /mnt/mtd/app has 0777 permissions, enabling local users to replace an archive file in that direct...

CVE-2018-19069

The CVE-2018-19069 entry affects Foscam C2 devices (System Firmware 1.11.1.8 and App Firmware 2.72.1.32) and Opticam i5 devices (System Firmware 1.5.2.11 and App Firmware 2.21.1.128). The issue involves CGIProxy.fcgi?cmd=setTelnetSwitch being authorized for the root user with the password “toor,”...

CVE-2018-19075

The CVE-2018-19075 entry concerns Foscam C2 devices (System Firmware 1.11.1.8 and Application 2.72.1.32) and Opticam i5 devices (System Firmware 1.5.2.11 and Application 2.21.1.128). The issue is tied to the firewall feature, where remote attackers could infer credentials and firewall rules due t...

CVE-2018-19075

An issue was discovered on Foscam C2 devices with System Firmware 1.11.1.8 and Application Firmware 2.72.1.32, and Opticam i5 devices with System Firmware 1.5.2.11 and Application Firmware 2.21.1.128. The firewall feature makes it easier for remote attackers to ascertain credentials and firewall...

CVE-2018-19064

An issue was discovered on Foscam C2 devices with System Firmware 1.11.1.8 and Application Firmware 2.72.1.32, and Opticam i5 devices with System Firmware 1.5.2.11 and Application Firmware 2.21.1.128. The ftpuser1 account has a blank password, which cannot be changed...

PT-2018-14784

Name of the Vulnerable Software and Affected Versions Foscam C2 versions 1.11.1.8 Foscam C2 Application Firmware versions 2.72.1.32 Opticam i5 versions 1.5.2.11 Opticam i5 Application Firmware versions 2.21.1.128 Description An issue was discovered that allows local users to control the commands...

PT-2018-14783

Name of the Vulnerable Software and Affected Versions Foscam C2 versions 1.11.1.8 Opticam i5 versions 1.5.2.11 Description An issue allows remote attackers to execute arbitrary OS commands via shell metacharacters in the usrName parameter of a "CGIProxy.fcgi addAccount action". Recommendations Fo...

PT-2018-14778

Name of the Vulnerable Software and Affected Versions Foscam C2 versions 1.11.1.8 Foscam C2 Application Firmware versions 2.72.1.32 Opticam i5 versions 1.5.2.11 Opticam i5 Application Firmware versions 2.21.1.128 Description An issue was discovered where the exported device configuration is...

PT-2018-14787

Name of the Vulnerable Software and Affected Versions Foscam C2 versions 1.11.1.8 Foscam C2 Application Firmware versions 2.72.1.32 Opticam i5 versions 1.5.2.11 Opticam i5 Application Firmware versions 2.21.1.128 Description An issue was discovered where the firewall has limited effectiveness, on...

PT-2018-14782

Name of the Vulnerable Software and Affected Versions Foscam C2 versions System Firmware 1.11.1.8 and Application Firmware 2.72.1.32 Opticam i5 versions System Firmware 1.5.2.11 and Application Firmware 2.21.1.128 Description An issue was discovered related to the CGIProxy.fcgi feature,...

PT-2018-14780

Name of the Vulnerable Software and Affected Versions Foscam C2 versions 1.11.1.8 Foscam C2 Application Firmware versions 2.72.1.32 Opticam i5 versions 1.5.2.11 Opticam i5 Application Firmware versions 2.21.1.128 Description An issue was discovered where there is a hardcoded Ak47@99 password for...

CVE-2018-19071: Incorrect Permission Assignment for Critical Resource

An issue was discovered on Foscam C2 devices with System Firmware 1.11.1.8 and Application Firmware 2.72.1.32, and Opticam i5 devices with System Firmware 1.5.2.11 and Application Firmware 2.21.1.128. /mnt/mtd/boot.sh has 0777 permissions, allowing local users to control the commands executed at...

CVE-2018-19072: Incorrect Permission Assignment for Critical Resource

An issue was discovered on Foscam C2 devices with System Firmware 1.11.1.8 and Application Firmware 2.72.1.32, and Opticam i5 devices with System Firmware 1.5.2.11 and Application Firmware 2.21.1.128. /mnt/mtd/app has 0777 permissions, allowing local users to replace an archive file within that...

CVE-2018-19074: Undefined Security Weakness

An issue was discovered on Foscam C2 devices with System Firmware 1.11.1.8 and Application Firmware 2.72.1.32, and Opticam i5 devices with System Firmware 1.5.2.11 and Application Firmware 2.21.1.128. The firewall has no effect except for blocking port 443 and partially blocking port 88...

CVE-2018-19073: Improper Neutralization of Special Elements used in an OS Command

An issue was discovered on Foscam C2 devices with System Firmware 1.11.1.8 and Application Firmware 2.72.1.32, and Opticam i5 devices with System Firmware 1.5.2.11 and Application Firmware 2.21.1.128. They allow attackers to execute arbitrary OS commands via shell metacharacters in the modelName,...

CVE-2018-19063: Use of Hard-coded Credentials

An issue was discovered on Foscam C2 devices with System Firmware 1.11.1.8 and Application Firmware 2.72.1.32, and Opticam i5 devices with System Firmware 1.5.2.11 and Application Firmware 2.21.1.128. The admin account has a blank password...