CVE-2018-19066

The CVE-2018-19066 entry concerns hardcoded credentials in device configuration handling. Affected devices include Foscam C2 (System FW 1.11.1.8 and App FW 2.72.1.32) and Opticam i5 (System FW 1.5.2.11 and App FW 2.21.1.128). The issue is that the exported device configuration is encrypted with t...

CVE-2018-19067

An issue was discovered on Foscam C2 devices with System Firmware 1.11.1.8 and Application Firmware 2.72.1.32, and Opticam i5 devices with System Firmware 1.5.2.11 and Application Firmware 2.21.1.128. There is a hardcoded Ak47@99 password for the factory account...

CVE-2018-19068

An issue was discovered on Foscam Opticam i5 devices with System Firmware 1.5.2.11 and Application Firmware 2.21.1.128. The CGIProxy.fcgi?cmd=setTelnetSwitch feature is authorized for hidden factory credentials...

CVE-2018-19076

An issue was discovered on Foscam C2 devices with System Firmware 1.11.1.8 and Application Firmware 2.72.1.32, and Opticam i5 devices with System Firmware 1.5.2.11 and Application Firmware 2.21.1.128. The FTP and RTSP services make it easier for attackers to conduct brute-force authentication...

CVE-2018-19077

An issue was discovered on Foscam Opticam i5 devices with System Firmware 1.5.2.11 and Application Firmware 2.21.1.128. RtspServer allows remote attackers to cause a denial of service daemon hang or restart via a negative integer in the RTSP Content-Length header...

CVE-2018-19078

An issue was discovered on Foscam Opticam i5 devices with System Firmware 1.5.2.11 and Application Firmware 2.21.1.128. The response to an ONVIF media GetStreamUri request contains the administrator username and password...

CVE-2018-19073

An issue was discovered on Foscam C2 devices with System Firmware 1.11.1.8 and Application Firmware 2.72.1.32, and Opticam i5 devices with System Firmware 1.5.2.11 and Application Firmware 2.21.1.128. They allow attackers to execute arbitrary OS commands via shell metacharacters in the modelName,...

CVE-2018-19074

An issue was discovered on Foscam C2 devices with System Firmware 1.11.1.8 and Application Firmware 2.72.1.32, and Opticam i5 devices with System Firmware 1.5.2.11 and Application Firmware 2.21.1.128. The firewall has no effect except for blocking port 443 and partially blocking port 88...

CVE-2018-19075

The CVE-2018-19075 entry concerns Foscam C2 devices (System Firmware 1.11.1.8 and Application 2.72.1.32) and Opticam i5 devices (System Firmware 1.5.2.11 and Application 2.21.1.128). The issue is tied to the firewall feature, where remote attackers could infer credentials and firewall rules due t...

CVE-2018-19075

An issue was discovered on Foscam C2 devices with System Firmware 1.11.1.8 and Application Firmware 2.72.1.32, and Opticam i5 devices with System Firmware 1.5.2.11 and Application Firmware 2.21.1.128. The firewall feature makes it easier for remote attackers to ascertain credentials and firewall...

CVE-2018-19063

The CVE-2018-19063 entry concerns Foscam C2 devices (System Firmware 1.11.1.8 and Application Firmware 2.72.1.32) and Opticam i5 devices (System Firmware 1.5.2.11 and Application Firmware 2.21.1.128) where the admin account has a blank password. The available connected records confirm affected mo...

CVE-2018-19064

The CVE-2018-19064 entry affects Foscam C2 devices (System FW 1.11.1.8; App FW 2.72.1.32) and Opticam i5 devices (System FW 1.5.2.11; App FW 2.21.1.128). The vulnerability is that the ftpuser1 account has a blank password which cannot be changed. The provided documents identify this credential is...

CVE-2018-19080

Summary (CVE-2018-19080) : A persistent cross-site scripting vulnerability exists in the ONVIF devicemgmt SetHostname method on Foscam Opticam i5 devices (System Firmware 1.5.2.11, Application Firmware 2.21.1.128). The issue is unauthenticated and can persist in the device, enabling XSS. Affected...

CVE-2018-19082

Foscam Opticam i5 devices with System Firmware 1.5.2.11 and Application Firmware 2.21.1.128 expose a stack-based buffer overflow in ONVIF devicemgmt SetDNS when handling the IPv4Address field. The vulnerability is exploitable remotely over the network (no authentication) and can impact confidenti...

CVE-2018-19071

The vulnerability CVE-2018-19071 affects Foscam C2 devices (System 1.11.1.8, App 2.72.1.32) and Opticam i5 devices (System 1.5.2.11, App 2.21.1.128): /mnt/mtd/boot.sh is world-writable (0777), enabling local users to control the commands executed at system startup. This may allow modification of ...

CVE-2018-19071

An issue was discovered on Foscam C2 devices with System Firmware 1.11.1.8 and Application Firmware 2.72.1.32, and Opticam i5 devices with System Firmware 1.5.2.11 and Application Firmware 2.21.1.128. /mnt/mtd/boot.sh has 0777 permissions, allowing local users to control the commands executed at...

CVE-2018-19065

An issue was discovered on Foscam C2 devices with System Firmware 1.11.1.8 and Application Firmware 2.72.1.32, and Opticam i5 devices with System Firmware 1.5.2.11 and Application Firmware 2.21.1.128. The exported device configuration is encrypted with the hardcoded BpP+2R9Q password in some case...

CVE-2018-19072

The CVE-2018-19072 entry affects Foscam C2 devices (System Firmware 1.11.1.8 and Application Firmware 2.72.1.32) and Opticam i5 devices (System Firmware 1.5.2.11 and Application Firmware 2.21.1.128). /mnt/mtd/app has 0777 permissions, enabling local users to replace an archive file in that direct...

CVE-2018-19067

The CVE-2018-19067 entry concerns Foscam C2 devices (System Firmware 1.11.1.8 and Application Firmware 2.72.1.32) and Opticam i5 devices (System Firmware 1.5.2.11 and Application Firmware 2.21.1.128) that ship a hardcoded factory account password, Ak47@99. This is a credential issue relying on a ...

CVE-2018-19068

The CVE-2018-19068 entry concerns Foscam Opticam i5 devices running System Firmware 1.5.2.11 and Application Firmware 2.21.1.128. The vulnerability is that the CGIProxy.fcgi?cmd=setTelnetSwitch feature is authorized for hidden factory credentials, suggesting an unintended access path to hidden Te...