CVE-2020-36874

ACE SECURITY WIP-90113 HD cameras contain an unauthenticated configuration disclosure vulnerability in the /web/cgi-bin/hi3510/backup.cgi endpoint. The endpoint permits remote download of a compressed configuration backup without requiring authentication or authorization. The exposed backup may...

CVE-2020-36874: Missing Authentication for Critical Function

ACE SECURITY WIP-90113 HD cameras contain an unauthenticated configuration disclosure vulnerability in the /web/cgi-bin/hi3510/backup.cgi endpoint. The endpoint permits remote download of a compressed configuration backup without requiring authentication or authorization. The exposed backup may...

CVE-2020-36871: Missing Authentication for Critical Function

ESCAM QD-900 WIFI HD cameras contain an unauthenticated configuration disclosure vulnerability in the /web/cgi-bin/hi3510/backup.cgi endpoint. The endpoint allows remote download of a compressed configuration backup without requiring authentication or authorization. The exposed backup can include...

CVE-2018-12669

SV3C L-SERIES HD CAMERA V2.3.4.2103-S50-NTD-B20170508B and V2.3.4.2103-S50-NTD-B20170823B devices allow remote authenticated users to reset arbitrary accounts via a request to web/cgi-bin/hi3510/param.cgi...

Vulnerability Spotlight: Multiple Vulnerabilities in Foscam C1 Indoor HD Cameras

These vulnerabilities were discovered by Claudio Bozzato of Cisco Talos.Executive SummaryThe Foscam C1 Indoor HD Camera is a network-based camera that is marketed for use in a variety of applications, including use as a home security monitoring device. Talos recently identified several...

Buffer overflow

In the web management interface in Foscam C1 Indoor HD cameras with application firmware 2.52.2.37, a specially crafted HTTP request can cause a buffer overflow...

CVE-2017-2847

CVE-2017-2847 affects Foscam C1 Indoor HD Cameras via the web management CGIProxy.fcgi service. The vulnerability allows command injection through the CGIProxy setIpInfo path when configuring network settings. An attacker with an administrator account can supply crafted input in the DNS1 paramete...

CVE-2017-2851

In the web management interface in Foscam C1 Indoor HD cameras with application firmware 2.52.2.37, a specially crafted HTTP request can cause a buffer overflow...

CVE-2017-2844

In the web management interface in Foscam C1 Indoor HD cameras with application firmware 2.52.2.37, a specially crafted HTTP request can allow for a user to inject arbitrary data in the "msmtprc" configuration file resulting in command execution. An attacker can simply send an HTTP request to the...

CVE-2017-2844: Improper Neutralization of Special Elements used in an OS Command

In the web management interface in Foscam C1 Indoor HD cameras with application firmware 2.52.2.37, a specially crafted HTTP request can allow for a user to inject arbitrary data in the "msmtprc" configuration file resulting in command execution. An attacker can simply send an HTTP request to the...

PT-2017-15580

Name of the Vulnerable Software and Affected Versions Foscam C1 Indoor HD cameras version 2.52.2.37 Description A command injection issue exists in the web management interface, allowing an attacker to inject arbitrary shell characters during manual network configuration via a specially crafted...

PT-2017-15579

Name of the Vulnerable Software and Affected Versions Foscam C1 Indoor HD cameras version 2.52.2.37 Description A command injection issue exists in the web management interface of the affected device. This occurs when a specially crafted HTTP request is sent, allowing an attacker to inject...

PT-2017-15578

Name of the Vulnerable Software and Affected Versions Foscam C1 Indoor HD cameras version 2.52.2.37 Description A command injection issue exists in the web management interface of the affected device. This occurs when a specially crafted HTTP request is sent, allowing an attacker to inject...

PT-2017-15576

Name of the Vulnerable Software and Affected Versions Foscam C1 Indoor HD cameras version 2.52.2.37 Description A specially crafted HTTP request to the web management interface can allow a user to inject arbitrary data in the msmtprc configuration file, resulting in command execution. An attacker...

PT-2017-15582

Name of the Vulnerable Software and Affected Versions Foscam C1 Indoor HD cameras version 2.52.2.37 Description A specially crafted HTTP request can allow a user to inject arbitrary characters in the pureftpd.passwd file during a username change, which in turn allows for bypassing chroot...

PT-2017-15583

Name of the Vulnerable Software and Affected Versions Foscam C1 Indoor HD cameras version 2.52.2.37 Description A buffer overflow can occur in the web management interface of the affected cameras due to a specially crafted HTTP request. Recommendations For version 2.52.2.37, update the applicatio...