CVE-2017-9829

'/cgi-bin/admin/downloadMedias.cgi' of the web service in most of the VIVOTEK Network Cameras is vulnerable, which allows remote attackers to read any file on the camera's Linux filesystem via a crafted HTTP request containing ".." sequences. This vulnerability is already verified on VIVOTEK Network Camera IB8369/FD8164/FD816BA; most others have similar firmware that may be affected.

CVSS v3 7.5 HIGH
CVSS v2.0 5.0 MEDIUM

7.5^/10

CVSS v3 : HIGH

Vector : AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

5.0^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:L/Au:N/C:P/I:N/A:N

Exploitability : 10.0 / Impact : 2.9

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact NONE

Availability Impact NONE

References

Link	Resource
https://blog.cal1.cn/post/An%20easy%20way%20to%20pwn%20most%20of%20the%20vivotek%20network%20cameras	Third Party Advisory

Configurations

Configuration 1 (hide)

AND

cpe:2.3:o:vivotek:network_camera_ib8369_firmware:ib8369-vvtk-0102a:*:*:*:*:*:*:*

cpe:2.3:h:vivotek:network_camera_ib8369:-:*:*:*:*:*:*:*

Configuration 2 (hide)

AND

cpe:2.3:o:vivotek:network_camera_fd8164_firmware:fd8164-_vvtk-0200b:*:*:*:*:*:*:*

cpe:2.3:h:vivotek:network_camera_fd8164:-:*:*:*:*:*:*:*

Configuration 3 (hide)

AND

cpe:2.3:o:vivotek:network_camera_fd816ba_firmware:fd816ba-vvtk-010101.:*:*:*:*:*:*:*

cpe:2.3:h:vivotek:network_camera_fd816ba:-:*:*:*:*:*:*:*

History

No history.

Information

Published : 2017-06-23 22:29

Updated : 2024-02-28 16:04

NVD link : CVE-2017-9829

Mitre link : CVE-2017-9829

CVE.ORG link : CVE-2017-9829

JSON object : View

Products Affected

vivotek

network_camera_ib8369
network_camera_fd816ba_firmware
network_camera_fd8164_firmware
network_camera_ib8369_firmware
network_camera_fd816ba
network_camera_fd8164

CWE

CWE-22

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

{"id": "CVE-2017-9829", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 5.0, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N", "authentication": "NONE", "integrityImpact": "NONE", "accessComplexity": "LOW", "availabilityImpact": "NONE", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV30": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.0", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 3.9}]}, "published": "2017-06-23T22:29:00.210", "references": [{"url": "https://blog.cal1.cn/post/An%20easy%20way%20to%20pwn%20most%20of%20the%20vivotek%20network%20cameras", "tags": ["Third Party Advisory"], "source": "cve@mitre.org"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-22"}]}], "descriptions": [{"lang": "en", "value": "'/cgi-bin/admin/downloadMedias.cgi' of the web service in most of the VIVOTEK Network Cameras is vulnerable, which allows remote attackers to read any file on the camera's Linux filesystem via a crafted HTTP request containing \"..\" sequences. This vulnerability is already verified on VIVOTEK Network Camera IB8369/FD8164/FD816BA; most others have similar firmware that may be affected."}, {"lang": "es", "value": "'/cgi-bin/admin/downloadMedias.cgi' del servicio web en la mayor\u00eda de las VIVOTEK Network Cameras es vulnerable, lo que permite a un atacante remoto leer cualquier archivo del sistema de ficheros Linux de las c\u00e1maras mediante una solicitud HTTP manipulada que contenga secuencias \"..\". Esta vulnerabilidad ya esta verificada en VIVOTEK Network Camera IB8369/FD8164/FD816BA; muchas de la otras tienen un firmware similar que tambi\u00e9n puede ser afectado."}], "lastModified": "2017-07-05T17:49:02.913", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:vivotek:network_camera_ib8369_firmware:ib8369-vvtk-0102a:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "02C5DB13-2631-42A1-9D33-109626D9B2AA"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:vivotek:network_camera_ib8369:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "2CED8977-65CE-47C7-B62D-D604429BF3DF"}], "operator": "OR"}], "operator": "AND"}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:vivotek:network_camera_fd8164_firmware:fd8164-_vvtk-0200b:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "BEDC585B-65BF-4A18-96A3-440A45B5527B"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:vivotek:network_camera_fd8164:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "62D8DD51-8504-493F-A8A2-D260D785903E"}], "operator": "OR"}], "operator": "AND"}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:vivotek:network_camera_fd816ba_firmware:fd816ba-vvtk-010101.:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "A8E8D766-0F98-4FDB-95AA-C48B5991DED5"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:vivotek:network_camera_fd816ba:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "5C83867F-EEC1-4C38-90F7-FB32DAB32455"}], "operator": "OR"}], "operator": "AND"}], "sourceIdentifier": "cve@mitre.org"}