CVE-2017-2872: Improper Authentication

Insufficient security checks exist in the recovery procedure used by the Foscam C1 Indoor HD Camera running application firmware 2.52.2.43. A HTTP request can allow for a user to perform a firmware upgrade using a crafted image. Before any firmware upgrades in this image are flashed to the device...

CVE-2017-2874: Undefined Security Weakness

An information disclosure vulnerability exists in the Multi-Camera interface used by the Foscam C1 Indoor HD Camera running application firmware 2.52.2.43. A specially crafted request on port 10001 can allow for a user to retrieve sensitive information without authentication...

PT-2018-7217

Name of the Vulnerable Software and Affected Versions: Foscam C1 Indoor HD Camera version 2.52.2.43 Description: Insufficient security checks exist in the recovery procedure used by the Foscam C1 Indoor HD Camera. A HTTP request can allow a user to perform a firmware upgrade using a crafted image...

CVE-2017-2857: Buffer Copy without Checking Size of Input

An exploitable buffer overflow vulnerability exists in the DDNS client used by the Foscam C1 Indoor HD Camera running application firmware 2.52.2.43. On devices with DDNS enabled, an attacker who is able to intercept HTTP connections will be able to fully compromise the device by creating a rogue...

PT-2018-7206

Name of the Vulnerable Software and Affected Versions: Foscam C1 Indoor HD Camera version 2.52.2.43 Description: A buffer overflow issue exists in the DDNS client of the affected device. This can be exploited by an attacker who intercepts HTTP connections, allowing them to fully compromise the...

CVE-2017-2833

The vulnerability CVE-2017-2833 affects the Foscam C1 Indoor HD Camera (firmware 2.52.2.37). During boot, the webService startup config builds an FTP command line using user-supplied credentials without sanitization, and then invokes system(). If an administrative account is compromised, an attac...

PT-2018-7202

Name of the Vulnerable Software and Affected Versions: Foscam C1 Indoor HD Camera version 2.52.2.37 Description: A command injection issue exists in the web management interface of the affected device. It allows an attacker to inject arbitrary shell characters through a specially crafted HTTP...

CVE-2017-2832: Improper Neutralization of Special Elements used in a Command

An exploitable command injection vulnerability exists in the web management interface used by the Foscam C1 Indoor HD Camera running application firmware 2.52.2.37. A specially crafted HTTP request can allow for a user to inject arbitrary shell characters during a password change resulting in...

PT-2018-7201

Name of the Vulnerable Software and Affected Versions: Foscam C1 Indoor HD Camera version 2.52.2.37 Description: A command injection issue exists in the web management interface of the affected device. It allows an attacker to inject arbitrary shell characters during a password change, resulting ...

CVE-2017-2833: Improper Neutralization of Special Elements used in a Command

An exploitable command injection vulnerability exists in the web management interface used by the Foscam C1 Indoor HD Camera running application firmware 2.52.2.37. A specially crafted HTTP request can allow for a user to inject arbitrary shell characters resulting in command injection during the...

CVE-2017-2871

CVE-2017-2871 affects Foscam C1 Indoor HD Camera (System 1.9.3.18; App 2.52.2.43; Plug‑in 3.3.0.26). The recovery procedure allows firmware image recovery via TFTP (and SD card with admin privileges), bypassing authentication and enabling full device compromise. The exploit uses an unsigned recov...

Vulnerability Spotlight: Foscam IP Video Camera Firmware Recovery Unsigned Image Vulnerability

This vulnerability was discovered by Claudio Bozzato of Cisco Talos. Executive Summary The Foscam C1 Indoor HD Camera is a network-based camera that is marketed for a variety of uses, including as a home security monitoring device. Talos recently identified 32 vulnerabilities present in these...

PT-2018-7216

Name of the Vulnerable Software and Affected Versions: Foscam C1 Indoor HD Camera version 2.52.2.43 Description: Insufficient security checks exist in the recovery procedure used by the Foscam C1 Indoor HD Camera. An attacker who is in the same subnetwork of the camera or has remote administrator...

CVE-2017-2871: Improper Authentication

Insufficient security checks exist in the recovery procedure used by the Foscam C1 Indoor HD Camera running application firmware 2.52.2.43. An attacker who is in the same subnetwork of the camera or has remote administrator access can fully compromise the device by performing a firmware recovery...

Foscam IP Video Camera webService oray.com DDNS Client Code Execution Vulnerability

Summary An exploitable buffer overflow vulnerability exists in the DDNS client used by the Foscam C1 Indoor HD Camera running application firmware 2.52.2.43. On devices with DDNS enabled, an attacker who is able to intercept HTTP connections will be able to fully compromise the device by creating...

Foscam IP Video Camera CGIProxy.fcgi SMTP Test Sender Parameter Configuration Command Injection Vulnerability(CVE-2017-2844)

Summary An exploitable command injection vulnerability exists in the web management interface used by the Foscam C1 Indoor HD Camera running application firmware 2.52.2.37. A specially crafted HTTP request can allow for a user to inject arbitrary data in the "msmtprc" configuration file resulting...

CVE-2017-2850

In the web management interface in Foscam C1 Indoor HD cameras with application firmware 2.52.2.37, a specially crafted HTTP request can allow for a user to inject arbitrary characters in the pureftpd.passwd file during a username change, which in turn allows for bypassing chroot restrictions in...

PT-2017-15577

Name of the Vulnerable Software and Affected Versions Foscam C1 Indoor HD Camera version 2.52.2.37 Description An exploitable command injection issue exists in the web management interface. A specially crafted HTTP request can allow a user to inject arbitrary shell characters during the SMTP...

CVE-2017-2845: Improper Neutralization of Special Elements used in an OS Command

An exploitable command injection vulnerability exists in the web management interface used by the Foscam C1 Indoor HD Camera running application firmware 2.52.2.37. A specially crafted HTTP request can allow for a user to inject arbitrary shell characters during the SMTP configuration tests...

Design/Logic Flaw

In the web management interface in Foscam C1 Indoor HD Camera running application firmware 2.52.2.37, a specially crafted HTTP request can allow for a user to inject arbitrary data in the "msmtprc" configuration file resulting in command execution. An attacker can simply send an HTTP request to t...