CVE-2017-17761

CVE-2017-17761 affects Ichano AtHome IP Camera devices. The issue resides in the bundled noodles service on port 1300, which allows a remote LAN attacker, without authentication, to execute arbitrary commands. The attack relies on the binary accepting a command via a … XML element, with responses...

CVE-2017-17761

An issue was discovered on Ichano AtHome IP Camera devices. The device runs the "noodles" binary - a service on port 1300 that allows a remote LAN unauthenticated user to run arbitrary commands. This binary requires the "system" XML element for specifying the command. For example, a id command...

CVE-2017-17107

Zivif PR115-204-P-RS V2.3.4.2103 web cameras contain a hard-coded cat1029 password for the root user. The SONIX operating system's setup renders this password unchangeable and it can be used to access the device via a TELNET session...

CVE-2017-17107

CVE-2017-17107 affects Zivif PR115-204-P-RS Webcams (version 2.3.4.2103). The root user password is hard-coded as cat1029, and the SONIX OS setup makes it unchangeable, enabling root access via TELNET. This CVE is part of a set (CVE-2017-17105, -17106, -17107) describing authentication bypass, co...

CVE-2017-17105

CVE-2017-17105 affects Zivif PR115-204-P-RS webcams (notably V2.3.4.2103 and V4.7.4.2121 and potentially intermediate builds). The vulnerability is an unauthenticated, blind remote command injection via CGI scripts used in the web interface, demonstrated by a request such as cgi-bin/iptest.cgi?cm...

nsd Format String

STX Subject: Remote Stack Format String in 'nsd' binary from multiple OEM Attack vector: Remote Authentication: Anonymous no credentials needed Researcher: bashis December 2017 PoC: https://github.com/mcw0/PoC Release date: December 14, 2017 Full Disclosure: 0-Day - PoC - 1 $ curl...

Multiple OEM - 'nsd' Remote Stack Format String (PoC)

STX Subject: Remote Stack Format String in 'nsd' binary from multiple OEM Attack vector: Remote Authentication: Anonymous no credentials needed Researcher: bashis December 2017 PoC: https://github.com/mcw0/PoC Release date: December 14, 2017 Full Disclosure: 0-Day - PoC - 1 $ curl...

Zivif PR115-204-P-RS 2.3.4.2103 Bypass / Command Injection / Hardcoded Password Vulnerabilities

Zivif PR115-204-P-RS cameras version 2.3.4.2103 suffer from authentication bypass, command injection, and hardcoded password vulnerabilities. Researcher: Silas Cutler p1nk Release date: December 10, 2017 Full Disclosure: 90 days CVEs: CVE-2017-17105, CVE-2017-17106, and CVE-2017-17107 Vulnerable...

AXIS HTTP GET Heap Overflow

The remote AXIS device is affected by a heap overflow vulnerability in its web administration interface due to a flaw in handling of special characters. An unauthenticated remote attacker can exploit this vulnerability for denial of service and possibly remote code execution. C Tenable Network...

CVE-2017-13169

An information disclosure vulnerability in the kernel camera server. Product: Android. Versions: Android kernel. Android ID A-37512375...

Information disclosure

An information disclosure vulnerability in the kernel camera server. Product: Android. Versions: Android kernel. Android ID A-37512375...

UBUNTU-CVE-2017-13169

An information disclosure vulnerability in the kernel camera server. Product: Android. Versions: Android kernel. Android ID A-37512375...

CVE-2017-13169

An information disclosure vulnerability in the kernel camera server. Product: Android. Versions: Android kernel. Android ID A-37512375...

CVE-2017-13169

CVE-2017-13169 is an information-disclosure vulnerability in the Android kernel camera server. Affected: Android kernel (kernel camera server). Root cause not explicitly detailed in provided documents. Impact: confidentiality leakage (per CVSS metrics: partial in v2, high in v3; no integrity/avai...

CVE-2017-13169

An information disclosure vulnerability in the kernel camera server. Product: Android. Versions: Android kernel. Android ID A-37512375...

Google Android Kernel Camera Server Information Disclosure Vulnerability

Android on Google Pixel and Nexus is an open source Linux-based operating system for Google Pixel and Nexus smartphones developed by Google and the Open Handheld Alliance OHA. Kernel Camera server is one of the kernel camera servers. An information disclosure vulnerability exists in the Kernel...

Google Android Qualcomm component elevation of privilege vulnerability (CNVD-2017-36515)

Android is a free and open source Linux-based operating system led and developed by Google Inc. and the Open Handset Alliance. An elevation of privilege vulnerability exists in the Google Android Camera Qualcomm component. An attacker can exploit this vulnerability to achieve elevation of privile...

CVE-2017-9703

In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, a race condition in a Camera driver can lead to a Use After Free condition...

CVE-2017-9708

In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, in the camera driver, the function "msmoispowerdown" is called without a mutex and a race condition can occur in variable "regptr" of sub function "msmcameraconfigsinglevreg"...

Race condition

In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, in the camera driver, the function "msmoispowerdown" is called without a mutex and a race condition can occur in variable "regptr" of sub function "msmcameraconfigsinglevreg"...