CVE-2018-6831

CVE-2018-6831 is a shell command injection in Foscam cameras’ CGIProxy.fcgi setSystemTime path. It allows an authenticated admin to craft ntpServer input (not sanitized) that is passed to a shell via popen, enabling root command execution. Affected products include C1 Lite V3, C1 V3, FI9800P/V3, ...

CVE-2018-6830

CVE-2018-6830 is a directory traversal vulnerability affecting multiple Foscam cameras (e.g., C1 Lite V3, C1 V3, FI9800P V3, FI9821P V3, FI9831P V3, FI9851P V3, and related models) where an unauthenticated attacker can delete arbitrary files by using .. in the URI path. The issue stems from vendo...

CVE-2018-6832

CVE-2018-6832 is a stack-based buffer overflow in Foscam’s webService getSWFlag routine. An unauthenticated GET request to /CGIProxy.fcgi?cmd=getSWFlag that includes a long callbackJson parameter overflows a stack buffer (callbackJson_var), crashing the webService and triggering watchdog restart,...