CVE-2017-9828

CVE-2017-9828 affects VIVOTEK Network Cameras (notably IB8369/FD8164/FD816BA). The web service CGI /cgi-bin/admin/testserver.cgi is vulnerable to shell command injection, allowing remote execution of commands as root via a crafted HTTP request. An attack uses shell metacharacters in the senderema...

CVE-2017-9829

CVE-2017-9829 affects VIVOTEK Network Cameras (IB8369, FD8164, FD816BA; with similar firmware) via /cgi-bin/admin/downloadMedias.cgi, allowing remote attackers to read arbitrary files on the device by crafting HTTP requests containing .. sequences. The vulnerability is documented as directory tra...