/cgi-bin/wapopen in Boa 0.94.14rc21 allows the injection of "../.." using the FILECAMERA variable (sent by GET) to read files with root privileges. NOTE: multiple third parties report that this is a system-integrator issue (e.g., a vulnerability on one type of camera) because Boa does not include any wapopen program or any code to read a FILECAMERA variable.
References
Link | Resource |
---|---|
https://pastebin.com/raw/rt7LJvyF | Exploit Third Party Advisory |
https://www.exploit-db.com/exploits/42290/ | Exploit Third Party Advisory VDB Entry |
Configurations
History
07 Nov 2023, 02:50
Type | Values Removed | Values Added |
---|---|---|
Summary | /cgi-bin/wapopen in Boa 0.94.14rc21 allows the injection of "../.." using the FILECAMERA variable (sent by GET) to read files with root privileges. NOTE: multiple third parties report that this is a system-integrator issue (e.g., a vulnerability on one type of camera) because Boa does not include any wapopen program or any code to read a FILECAMERA variable. |
Information
Published : 2017-06-24 02:29
Updated : 2024-08-05 18:15
NVD link : CVE-2017-9833
Mitre link : CVE-2017-9833
CVE.ORG link : CVE-2017-9833
JSON object : View
Products Affected
boa
- boa
CWE
CWE-22
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')