CVE-2017-2805

An exploitable stack-based buffer overflow vulnerability exists in the web management interface used by the Foscam C1 Indoor HD Camera. A specially crafted http request can cause a stack-based buffer overflow resulting in overwriting arbitrary data on the stack frame. An attacker can simply send ...

CVE-2017-2830

Foscam C1 Indoor HD Camera is affected by a stack-based buffer overflow in the CGIProxy.fcgi web service. The flaw occurs while parsing multipart/form-data during a POST (usrBeatHeart/0x3001 flow); a boundary string larger than 0x100 bytes overflows a stack buffer, enabling potential code executi...

CVE-2017-2828

CVE-2017-2828 affects Foscam C1 Indoor HD Camera via CGIProxy.fcgi (web management) where changePassword allows command injection. The vulnerability stems from processing of the newPwd parameter: after validating user exists and that the old password matches, the code builds a shell command strin...

CVE-2017-2827

The CVE-2017-2827 issue affects Foscam C1 Indoor HD Cameras via the CGIProxy.fcgi service in the web management interface. An account creation command (addAccount) accepts usrName, usrPwd, and privilege (required to be 2) and passes these to FTPconfigUser, which builds a shell command: sh /usr/bi...

CVE-2017-2830

An exploitable buffer overflow vulnerability exists in the web management interface used by the Foscam C1 Indoor HD Camera running application firmware 2.52.2.37. A specially crafted HTTP request can cause a buffer overflow resulting in overwriting arbitrary data. An attacker can simply send an...

CVE-2017-2827

An exploitable command injection vulnerability exists in the web management interface used by the Foscam C1 Indoor HD Camera running application firmware 2.52.2.37. A specially crafted HTTP request can allow for a user to inject arbitrary shell characters during account creation resulting in...

CVE-2017-2831

CVE-2017-2831 affects Foscam C1 Indoor HD Camera (firmware 2.52.2.37). The CGIProxy.fcgi web interface contains a stack-based buffer overflow: the query string is decoded and copied into a 0x400-byte buffer, then concatenated with REMOTE_ADDR and optional remoteP2P data, which writes beyond the b...

CVE-2017-2831

An exploitable buffer overflow vulnerability exists in the web management interface used by the Foscam C1 Indoor HD Camera running application firmware 2.52.2.37. A specially crafted HTTP request can cause a buffer overflow resulting in overwriting arbitrary data. An attacker can simply send an...

PT-2017-15547 · Foscam · Foscam C1 Indoor Hd Camera

Name of the Vulnerable Software and Affected Versions: Foscam C1 Indoor HD Camera affected versions not specified Description: A stack-based buffer overflow issue exists in the web management interface of the affected device. This can be triggered by a specially crafted HTTP request, leading to a...

PT-2017-9770 · Foscam · Foscam C1

Name of the Vulnerable Software and Affected Versions: Foscam C1 version 1.9.1.12 Description: The issue concerns hard-coded FTP credentials, specifically r:r, included in the firmware. This could allow remote access to cameras connected to the internet without port 50021 blocked by an intermedia...

Vulnerability Spotlight: Multiple Foscam C1 Vulnerabilities Come in to Focus

Executive SummaryThe Foscam C1 is a webcam that is marketed for use in a variety of applications including home security monitoring. As an indoor webcam, it is designed to be set up inside of a building and features the ability to be accessed remotely via a web interface or from within a mobile...

Foscam IP Video Camera CGIProxy.fcgi Gateway Address Configuration Command Injection Vulnerability

Summary An exploitable command injection vulnerability exists in the web management interface used by the Foscam C1 Indoor HD Camera running application firmware 2.52.2.37. A specially crafted HTTP request can allow for a user to inject arbitrary shell characters during manual network configurati...

Foscam IP Video Camera CGIProxy.fcgi Message 0x3001 Directory Traversal Vulnerability

Summary An exploitable directory traversal vulnerability exists in the web management interface used by the Foscam C1 Indoor HD Camera running application firmware 2.52.2.37. A specially crafted HTTP request can cause the application to read a file from disk but a failulre to adequately filter...

Foscam IP Video Camera CGIProxy.fcgi Account Password Command Injection Vulnerability

Summary An exploitable command injection vulnerability exists in the web management interface used by the Foscam C1 Indoor HD Camera running application firmware 2.52.2.37. A specially crafted HTTP request can allow for a user to inject arbitrary shell characters during a password change resultin...

Foscam IP Video Camera CGIProxy.fcgi DNS1 Address Configuration Command Injection Vulnerability

Summary An exploitable command injection vulnerability exists in the web management interface used by the Foscam C1 Indoor HD Camera running application firmware 2.52.2.37. A specially crafted HTTP request can allow for a user to inject arbitrary shell characters during manual network configurati...

Foscam IP Video Camera CGIProxy.fcgi SMTP Test User Parameter Configuration Command Injection Vulnerability

Summary An exploitable command injection vulnerability exists in the web management interface used by the Foscam C1 Indoor HD Camera running application firmware 2.52.2.37. A specially crafted HTTP request can allow for a user to inject arbitrary data in the “msmtprc” configuration file resulting...

Foscam IP Video Camera CGIProxy.fcgi Change Username pureftpd.passwd Injection Vulnerability

Summary An exploitable injection vulnerability exists in the web management interface used by the Foscam C1 Indoor HD Camera running application firmware 2.52.2.37. A specially crafted HTTP request can allow for a user to inject arbitrary characters in the pureftpd.passwd file during a username...

Foscam IP Video Camera CGIProxy.fcgi Account Creation Command Injection Vulnerability

Summary An exploitable command injection vulnerability exists in the web management interface used by the Foscam C1 Indoor HD Camera running application firmware 2.52.2.37. A specially crafted HTTP request can allow for a user to inject arbitrary shell characters during account creation resulting...

Foscam IP Video Camera WebService CGI Parameter Code Execution Vulnerability

Summary An exploitable stack-based buffer overflow vulnerability exists in the web management interface used by the Foscam C1 Indoor HD Camera. A specially crafted http request can cause a stack-based buffer overflow resulting in overwriting arbitrary data on the stack frame. An attacker can simp...

Foscam C1 Webcam FTP Hard Coded Password Vulnerability

Summary Hard-coded FTP credentials r:r are included in the Foscam C1 running firmware 1.9.1.12. Knowledge of these credentials would allow remote access to any cameras found on the internet that do not have port 50021 blocked by an intermediate device. Tested Versions Foscam C1 Firmware Version...