VIVOTEK FD8177 Command Injection Vulnerability

VIVOTEK FD8177 is a network camera product from VIVOTEK. A command injection vulnerability exists in versions prior to VIVOTEK FD8177 XXXXXX-VVTK-xx06a, which can be exploited by remote attackers to execute arbitrary code via the eventscript.cgi file...

CVE-2018-14768

Various VIVOTEK FD8, FD9, FE9, IB8, IB9, IP9, IZ9, MS9, SD9, and other devices before XXXXXX-VVTK-xx06a allow remote attackers to execute arbitrary code...

Code injection

Various VIVOTEK FD8, FD9, FE9, IB8, IB9, IP9, IZ9, MS9, SD9, and other devices before XXXXXX-VVTK-xx06a allow remote attackers to execute arbitrary code...

CVE-2018-14768

Various VIVOTEK FD8, FD9, FE9, IB8, IB9, IP9, IZ9, MS9, SD9, and other devices before XXXXXX-VVTK-xx06a allow remote attackers to execute arbitrary code...

CVE-2018-14768

Mode C: CVE-2018-14768 concerns VIVOTEK network cameras with firmware versions lower than XXXXXX-VVTK-0X06a, where an authenticated attacker can exploit a command-injection vulnerability via update_lens.cgi to execute arbitrary commands. Affected products include FD8*, FD9*, FE9*, IB8*, IB9*, IP9...

Vivotek IP Cameras - Remote Stack Overflow (PoC) Vulnerability

Exploit for multiple platform in category remote exploits STX Subject: Vivotek IP Cameras - Remote Stack Overflow Researcher: bashis September-October 2017 PoC: https://github.com/mcw0/PoC Release date: November 13, 2017 Full Disclosure: 43 days Attack Vector: Remote Authentication: Anonymous no...

Vivotek IP Cameras - Remote Stack Overflow (PoC)

STX Subject: Vivotek IP Cameras - Remote Stack Overflow Researcher: bashis September-October 2017 PoC: https://github.com/mcw0/PoC Release date: November 13, 2017 Full Disclosure: 43 days Attack Vector: Remote Authentication: Anonymous no credentials needed Firmware Vulnerable: Only 2017 versions...

Vivotek IP Cameras - Remote Stack Overflow (PoC)

Vivotek IP Cameras - Remote Stack Overflow PoC STX Subject: Vivotek IP Cameras - Remote Stack Overflow Researcher: bashis September-October 2017 PoC: https://github.com/mcw0/PoC Release date: November 13, 2017 Full Disclosure: 43 days Attack Vector: Remote Authentication: Anonymous no credentials...

Vivotek IP Cameras - Remote Stack Overflow

Subject: Vivotek IP Cameras - Remote Stack Overflow Researcher: bashis September-October 2017 PoC: https://github.com/mcw0/PoC Release date: November 13, 2017 Full Disclosure: 43 days Attack Vector: Remote Authentication: Anonymous no credentials needed Firmware Vulnerable: Only 2017 versions...

Vivotek IP Cameras Remote Stack Overflow

STX Subject: Vivotek IP Cameras - Remote Stack Overflow Researcher: bashis September-October 2017 PoC: https://github.com/mcw0/PoC Release date: November 13, 2017 Full Disclosure: 43 days Attack Vector: Remote Authentication: Anonymous no credentials needed Firmware Vulnerable: Only 2017 versions...

Vivotek IP Cameras Remote Stack Overflow Vulnerability

Many Vivotek IP cameras suffer from a remote stack overflow vulnerability. Device models include CC8160, CC8370, CC8371, CD8371, FD8166A, FD8166A, FD8166A-N, FD8167A, FD8167A, FD8167AS, FD8167AS, FD8169A, FD8169A, FD8169A, FD8169AS, FD8169AS, FD816B, FD816B, FD816BA, FD816BA, FD816C, FD816C,...

VIVOTEK Network Cameras IB8369, FD8164 and FD816BA Arbitrary File Read Vulnerabilities

VIVOTEK Network Cameras IB8369, FD8164 and FD816BA are network camera products from VIVOTEK, China. A security vulnerability exists in the /cgi-bin/admin/downloadMedias.cgi file of the web server in VIVOTEK Network Cameras IB8369, FD8164 and FD816BA. An attacker can exploit this vulnerability by...

Vulnerabilities in VIVOTEK Network Cameras IB8369, FD8164 and FD816BA

VIVOTEK Network Cameras IB8369, FD8164 and FD816BA are network camera products from VIVOTEK, China. A security vulnerability exists in the /cgi-bin/admin/testserver.cgi file of the Web services in VIVOTEK Network Cameras IB8369, FD8164 and FD816BA. The vulnerability can be exploited to execute...

Vivotek Network Camera arbitrary file reading and command execution vulnerability

Author: Super viagra the blue cat Within the network there are some Vivotek network camera, as a monitor. Direct access to the 80 port of the Web service, the Configure - maintenance - import/export file to export the configuration file, get a contains etc folder of the tar package. From a...

Command injection

'/cgi-bin/admin/testserver.cgi' of the web service in most of the VIVOTEK Network Cameras is vulnerable to shell command injection, which allows remote attackers to execute any shell command as root via a crafted HTTP request. This vulnerability is already verified on VIVOTEK Network Camera...

Design/Logic Flaw

'/cgi-bin/admin/downloadMedias.cgi' of the web service in most of the VIVOTEK Network Cameras is vulnerable, which allows remote attackers to read any file on the camera's Linux filesystem via a crafted HTTP request containing ".." sequences. This vulnerability is already verified on VIVOTEK...

CVE-2017-9828

'/cgi-bin/admin/testserver.cgi' of the web service in most of the VIVOTEK Network Cameras is vulnerable to shell command injection, which allows remote attackers to execute any shell command as root via a crafted HTTP request. This vulnerability is already verified on VIVOTEK Network Camera...

CVE-2017-9829

'/cgi-bin/admin/downloadMedias.cgi' of the web service in most of the VIVOTEK Network Cameras is vulnerable, which allows remote attackers to read any file on the camera's Linux filesystem via a crafted HTTP request containing ".." sequences. This vulnerability is already verified on VIVOTEK...

CVE-2017-9828

'/cgi-bin/admin/testserver.cgi' of the web service in most of the VIVOTEK Network Cameras is vulnerable to shell command injection, which allows remote attackers to execute any shell command as root via a crafted HTTP request. This vulnerability is already verified on VIVOTEK Network Camera...

CVE-2017-9829

'/cgi-bin/admin/downloadMedias.cgi' of the web service in most of the VIVOTEK Network Cameras is vulnerable, which allows remote attackers to read any file on the camera's Linux filesystem via a crafted HTTP request containing ".." sequences. This vulnerability is already verified on VIVOTEK...