CVE-2017-9829

{"id": "CVE-2017-9829", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 5.0, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N", "authentication": "NONE", "integrityImpact": "NONE", "accessComplexity": "LOW", "availabilityImpact": "NONE", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV30": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.0", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 3.9}]}, "published": "2017-06-23T22:29:00.210", "references": [{"url": "https://blog.cal1.cn/post/An%20easy%20way%20to%20pwn%20most%20of%20the%20vivotek%20network%20cameras", "tags": ["Third Party Advisory"], "source": "cve@mitre.org"}, {"url": "https://blog.cal1.cn/post/An%20easy%20way%20to%20pwn%20most%20of%20the%20vivotek%20network%20cameras", "tags": ["Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-22"}]}], "descriptions": [{"lang": "en", "value": "'/cgi-bin/admin/downloadMedias.cgi' of the web service in most of the VIVOTEK Network Cameras is vulnerable, which allows remote attackers to read any file on the camera's Linux filesystem via a crafted HTTP request containing \"..\" sequences. This vulnerability is already verified on VIVOTEK Network Camera IB8369/FD8164/FD816BA; most others have similar firmware that may be affected."}, {"lang": "es", "value": "'/cgi-bin/admin/downloadMedias.cgi' del servicio web en la mayor\u00eda de las VIVOTEK Network Cameras es vulnerable, lo que permite a un atacante remoto leer cualquier archivo del sistema de ficheros Linux de las c\u00e1maras mediante una solicitud HTTP manipulada que contenga secuencias \"..\". Esta vulnerabilidad ya esta verificada en VIVOTEK Network Camera IB8369/FD8164/FD816BA; muchas de la otras tienen un firmware similar que tambi\u00e9n puede ser afectado."}], "lastModified": "2024-11-21T03:36:56.230", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:vivotek:network_camera_ib8369_firmware:ib8369-vvtk-0102a:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "02C5DB13-2631-42A1-9D33-109626D9B2AA"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:vivotek:network_camera_ib8369:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "2CED8977-65CE-47C7-B62D-D604429BF3DF"}], "operator": "OR"}], "operator": "AND"}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:vivotek:network_camera_fd8164_firmware:fd8164-_vvtk-0200b:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "BEDC585B-65BF-4A18-96A3-440A45B5527B"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:vivotek:network_camera_fd8164:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "62D8DD51-8504-493F-A8A2-D260D785903E"}], "operator": "OR"}], "operator": "AND"}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:vivotek:network_camera_fd816ba_firmware:fd816ba-vvtk-010101.:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "A8E8D766-0F98-4FDB-95AA-C48B5991DED5"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:vivotek:network_camera_fd816ba:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "5C83867F-EEC1-4C38-90F7-FB32DAB32455"}], "operator": "OR"}], "operator": "AND"}], "sourceIdentifier": "cve@mitre.org"}