9.8crit
CVE-2016-8731
Hard-coded FTP credentials (r:r) are included in the Foscam C1 running firmware 1.9.1.12.
Published 9 y ago · modified 4 mo ago · JSON
CVSS
9.8
v3.0 · CNA
CISA KEV
No
not known exploited
EPSS
2.6%
percentile 86%
Public exploits
0
none known
Summary
Hard-coded FTP credentials (r:r) are included in the Foscam C1 running firmware 1.9.1.12. Knowledge of these credentials would allow remote access to any cameras found on the internet that do not have port 50021 blocked by an intermediate device.
Exploit prediction (EPSS)
2.65% probability of exploitation in the next 30 days, higher than 86% of all scored CVEs.
CVSS scores
| Assigned by | Version | Score | Vector |
|---|---|---|---|
| CNA | 3.0 | 9.8 | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| NVD | 3.1 | 9.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| CNA | 3.0 | 9.8 | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| NVD | 2.0 | 7.5 | AV:N/AC:L/Au:N/C:P/I:P/A:P |
Affected products
- Foscan Foscam C1 Webcam
Classification
- Weakness
- CWE-798 Use of Hard-coded Credentials
References
- securityfocus.com /bid/99193 · vdb-entry, x_refsource_BID, x_transferred
- talosintelligence.com /vulnerability_reports/TALOS-2016-0245 · x_refsource_MISC, x_transferred
Sources
- CVE List: CVE-2016-8731
- NVD: CVE-2016-8731
vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.