9.6crit
CVE-2017-2871
Insufficient security checks exist in the recovery procedure used by the Foscam C1 Indoor HD Camera running application firmware 2.52.2.43.
Published 8 y ago · modified 4 mo ago · JSON
CVSS
9.6
v3.0 · CNA
CISA KEV
No
not known exploited
EPSS
1.1%
percentile 65%
Public exploits
0
none known
Summary
Insufficient security checks exist in the recovery procedure used by the Foscam C1 Indoor HD Camera running application firmware 2.52.2.43. An attacker who is in the same subnetwork of the camera or has remote administrator access can fully compromise the device by performing a firmware recovery using a custom image.
Exploit prediction (EPSS)
1.07% probability of exploitation in the next 30 days, higher than 65% of all scored CVEs.
CVSS scores
| Assigned by | Version | Score | Vector |
|---|---|---|---|
| CNA | 3.0 | 9.6 | CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H |
| NVD | 3.1 | 8.8 | CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| CNA | 3.0 | 9.6 | CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H |
| NVD | 2.0 | 5.8 | AV:A/AC:L/Au:N/C:P/I:P/A:P |
Affected products
- Talos Foscam
Classification
- Weakness
- CWE-287 Improper Authentication
References
- talosintelligence.com /vulnerability_reports/TALOS-2017-0378 · x_refsource_MISC, x_transferred
Sources
- CVE List: CVE-2017-2871
- NVD: CVE-2017-2871
vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.