CVE-2018-6831

CVE-2018-6831 is a shell command injection in Foscam cameras’ CGIProxy.fcgi setSystemTime path. It allows an authenticated admin to craft ntpServer input (not sanitized) that is passed to a shell via popen, enabling root command execution. Affected products include C1 Lite V3, C1 V3, FI9800P/V3, ...

CVE-2017-2855

The CVE describes a buffer overflow in the Foscam C1 Indoor HD Camera’s DDNS client when configured with supported DDNS providers (e.g., 3322.net). The exploit chain relies on the device periodically contacting the configured DDNS server, parsing the response, and locating an IP address after a "...

CVE-2017-2873

The CVE-2017-2873 vulnerability affects Foscam C1 Indoor HD Camera (web management interface) where the SoftAP configuration can be manipulated via CGIProxy.fcgi?setSoftApConfig. The OnDevMngMsgSetSoftApConfig path copies fixed SSID with user-supplied PSK into the SoftAP config, then sub_4519C/su...

CVE-2017-2857

CVE-2017-2857 is a buffer overflow in the Foscam C1 Indoor HD Camera DDNS client when DDNS is enabled (notably 9299.org). The vulnerability arises in the DDNS update path: the code parses the response to extract the IP address after the “Current IP Address:” string without enforcing input size bo...

CVE-2017-2871

CVE-2017-2871 affects Foscam C1 Indoor HD Camera (System 1.9.3.18; App 2.52.2.43; Plug‑in 3.3.0.26). The recovery procedure allows firmware image recovery via TFTP (and SD card with admin privileges), bypassing authentication and enabling full device compromise. The exploit uses an unsigned recov...

CVE-2017-2877

CVE-2017-2877 : Foscam C1 Indoor HD Camera (firmware 2.52.2.43) is vulnerable via the Multi-Camera interface on UDP/10001. The vulnerability stems from a missing error check in the devMng path for command 0x0064, allowing an unauthenticated attacker to reset all user accounts to factory defaults ...

CVE-2017-2856

The CVE-2017-2856 issue is a buffer overflow in the Foscam C1 Indoor HD Camera DDNS client (firmware 2.52.2.43) when DDNS is enabled. TALOS reports that with the dyndns.com DDNS provider (and other providers) the client contacts the checkip.dyndns.com (or equivalent) service, reads an HTTP respon...

CVE-2017-2879

CVE-2017-2879 is a UPnP discovery buffer overflow in the Foscam C1 Indoor HD Camera’s UPnP webService. A crafted UDP response to a discovery request can overflow a stack/buffer, overwriting data and crashing the web service (PoC shows a 200 OK http://… payload triggering a crash). Affected firmwa...

CVE-2017-2854

Foscam C1 Indoor HD Camera (firmware 2.52.2.43) is affected by CVE-2017-2854 through its DDNS client. When configured to use the oray.com DDNS provider (ddnsServer=1) and with DDNS enabled, the update thread fetches the public IP via provider-specific code and processes server responses unsafely....

CVE-2017-2875

CVE-2017-2875 affects Foscam C1 Indoor HD Camera (firmware 2.52.2.43). The vulnerability resides in the devMng Multi-Camera port 10000 command 0x0002 handling, where lack of bounds checking on the username field can cause a buffer overflow, enabling remote code execution. The described exploit pa...

CVE-2017-2833

The vulnerability CVE-2017-2833 affects the Foscam C1 Indoor HD Camera (firmware 2.52.2.37). During boot, the webService startup config builds an FTP command line using user-supplied credentials without sanitization, and then invokes system(). If an administrative account is compromised, an attac...

CVE-2018-6830

CVE-2018-6830 is a directory traversal vulnerability affecting multiple Foscam cameras (e.g., C1 Lite V3, C1 V3, FI9800P V3, FI9821P V3, FI9831P V3, FI9851P V3, and related models) where an unauthenticated attacker can delete arbitrary files by using .. in the URI path. The issue stems from vendo...

CVE-2017-2876

CVE-2017-2876 affects the Foscam C1 Indoor HD Camera (System 1.9.3.18; Application 2.52.2.43). The issue is a buffer overflow in the Multi-Camera port 10000 (devMng) during authentication, where the username/password fields can overflow a small stack/IPC buffer, enabling a remote attacker to exec...

CVE-2017-2872

The CVE refers to Foscam C1 Indoor HD Camera (Application Firmware 2.52.2.43) where CGIProxy.fcgi allows an unauthenticated upgrade flow to execute a crafted image. In the connected TALOS/TALOS-2017-0379 material, an administrator-authenticated HTTP request triggers fwUpgrade, storing upgrade.bin...

CVE-2017-2874

CVE-2017-2874 affects the Foscam C1 Indoor HD Camera via the devMng Multi-Camera interface over UDP ports 10000/10001. The information-disclosure vulnerability can be triggered by an unauthenticated remote attacker using the find command (0x0000) to retrieve sensitive device data, including MAC a...

CVE-2018-6832

CVE-2018-6832 is a stack-based buffer overflow in Foscam’s webService getSWFlag routine. An unauthenticated GET request to /CGIProxy.fcgi?cmd=getSWFlag that includes a long callbackJson parameter overflows a stack buffer (callbackJson_var), crashing the webService and triggering watchdog restart,...

CVE-2017-2878

CVE-2017-2878 affects the Foscam C1 Indoor HD Camera web management interface. The issue is a buffer overflow in the CGIProxy.fcgi logOut path: a user-supplied username (buffer size up to 0x40) is copied into a 0x20-byte field via strcpy, allowing an attacker—requiring at least a visitor-privileg...

CVE-2017-2832

Summary : CVE-2017-2832 affects the Foscam C1 Indoor HD Camera via the CGIProxy.fcgi Account Deletion Command Injection vulnerability. The attacker must have an administrator account to exploit. During delAccount, the code path extracts usrName and passes it to a function that ultimately executes...