CVE-2017-2871

CVE-2017-2871 affects Foscam C1 Indoor HD Camera (System 1.9.3.18; App 2.52.2.43; Plug‑in 3.3.0.26). The recovery procedure allows firmware image recovery via TFTP (and SD card with admin privileges), bypassing authentication and enabling full device compromise. The exploit uses an unsigned recov...

Vulnerability Spotlight: Foscam IP Video Camera Firmware Recovery Unsigned Image Vulnerability

This vulnerability was discovered by Claudio Bozzato of Cisco Talos. Executive Summary The Foscam C1 Indoor HD Camera is a network-based camera that is marketed for a variety of uses, including as a home security monitoring device. Talos recently identified 32 vulnerabilities present in these...

Foscam IP Video Camera webService oray.com DDNS Client Code Execution Vulnerability

Summary An exploitable buffer overflow vulnerability exists in the DDNS client used by the Foscam C1 Indoor HD Camera running application firmware 2.52.2.43. On devices with DDNS enabled, an attacker who is able to intercept HTTP connections will be able to fully compromise the device by creating...

Foscam IP Video Camera CGIProxy.fcgi SMTP Test Sender Parameter Configuration Command Injection Vulnerability(CVE-2017-2844)

Summary An exploitable command injection vulnerability exists in the web management interface used by the Foscam C1 Indoor HD Camera running application firmware 2.52.2.37. A specially crafted HTTP request can allow for a user to inject arbitrary data in the "msmtprc" configuration file resulting...

CVE-2017-2850

In the web management interface in Foscam C1 Indoor HD cameras with application firmware 2.52.2.37, a specially crafted HTTP request can allow for a user to inject arbitrary characters in the pureftpd.passwd file during a username change, which in turn allows for bypassing chroot restrictions in...

Design/Logic Flaw

In the web management interface in Foscam C1 Indoor HD Camera running application firmware 2.52.2.37, a specially crafted HTTP request can allow for a user to inject arbitrary data in the "msmtprc" configuration file resulting in command execution. An attacker can simply send an HTTP request to t...

Buffer overflow

An exploitable buffer overflow vulnerability exists in the web management interface used by the Foscam C1 Indoor HD Camera running application firmware 2.52.2.37. A specially crafted HTTP request can cause a buffer overflow resulting in overwriting arbitrary data. An attacker can simply send an...

CVE-2017-2829

An exploitable directory traversal vulnerability exists in the web management interface used by the Foscam C1 Indoor HD Camera running application firmware 2.52.2.37. A specially crafted HTTP request can cause the application to read a file from disk but a failure to adequately filter characters...

Directory traversal

An exploitable directory traversal vulnerability exists in the web management interface used by the Foscam C1 Indoor HD Camera running application firmware 2.52.2.37. A specially crafted HTTP request can cause the application to read a file from disk but a failure to adequately filter characters...

CVE-2017-2805

The CVE-2017-2805 issue affects Foscam C1 Indoor HD Camera via the webService CGIProxy.fcgi. A stack-based buffer overflow is triggered by processing HTTP requests that carry parameters (usr, pwd, cmd). Each parameter buffer is 0x40 bytes; overflowing usr/pwd/cmd can overwrite adjacent stack data...

CVE-2017-2805

An exploitable stack-based buffer overflow vulnerability exists in the web management interface used by the Foscam C1 Indoor HD Camera. A specially crafted http request can cause a stack-based buffer overflow resulting in overwriting arbitrary data on the stack frame. An attacker can simply send ...

CVE-2017-2830

Foscam C1 Indoor HD Camera is affected by a stack-based buffer overflow in the CGIProxy.fcgi web service. The flaw occurs while parsing multipart/form-data during a POST (usrBeatHeart/0x3001 flow); a boundary string larger than 0x100 bytes overflows a stack buffer, enabling potential code executi...

HD Camera - Dangerous filesystem permissions, MIT license, WebView code execution vulnerabilities

HackApp vulnerability scanner discovered that application HD Camera published at the 'play' market has multiple vulnerabilities...

HD Camera Ultimate for Android - Dynamic Code Loading, External URLs, Native code usage vulnerabilities

HackApp vulnerability scanner discovered that application HD Camera Ultimate for Android published at the 'play' market has multiple vulnerabilities...

HD Camera Ultra - Dangerous filesystem permissions, WebView code execution vulnerabilities

HackApp vulnerability scanner discovered that application HD Camera Ultra published at the 'play' market has multiple vulnerabilities...