CVE-2017-2850

In the web management interface in Foscam C1 Indoor HD cameras with application firmware 2.52.2.37, a specially crafted HTTP request can allow for a user to inject arbitrary characters in the pureftpd.passwd file during a username change, which in turn allows for bypassing chroot restrictions in the FTP server. An attacker can simply send an HTTP request to the device to trigger this vulnerability.
References
Link Resource
http://www.securityfocus.com/bid/99184 Broken Link
https://talosintelligence.com/vulnerability_reports/TALOS-2017-0352 Technical Description Third Party Advisory VDB Entry
Configurations

Configuration 1 (hide)

AND
cpe:2.3:o:foscam:c1_indoor_hd_camera_firmware:2.52.2.37:*:*:*:*:*:*:*
cpe:2.3:h:foscam:c1_indoor_hd_camera:-:*:*:*:*:*:*:*

History

No history.

Information

Published : 2017-06-29 17:29

Updated : 2024-02-28 16:04


NVD link : CVE-2017-2850

Mitre link : CVE-2017-2850

CVE.ORG link : CVE-2017-2850


JSON object : View

Products Affected

foscam

  • c1_indoor_hd_camera
  • c1_indoor_hd_camera_firmware
CWE
CWE-78

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')