9.9crit
CVE-2017-2872
Insufficient security checks exist in the recovery procedure used by the Foscam C1 Indoor HD Camera running application firmware 2.52.2.43.
Published 8 y ago · modified 4 mo ago · JSON
CVSS
9.9
v3.0 · CNA
CISA KEV
No
not known exploited
EPSS
1.6%
percentile 76%
Public exploits
0
none known
Summary
Insufficient security checks exist in the recovery procedure used by the Foscam C1 Indoor HD Camera running application firmware 2.52.2.43. A HTTP request can allow for a user to perform a firmware upgrade using a crafted image. Before any firmware upgrades in this image are flashed to the device, binaries as well as arguments to shell commands contained in the image are executed with elevated privileges.
Exploit prediction (EPSS)
1.63% probability of exploitation in the next 30 days, higher than 76% of all scored CVEs.
CVSS scores
| Assigned by | Version | Score | Vector |
|---|---|---|---|
| CNA | 3.0 | 9.9 | CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H |
| NVD | 3.1 | 7.2 | CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H |
| CNA | 3.0 | 9.9 | CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H |
| NVD | 2.0 | 9.0 | AV:N/AC:L/Au:S/C:C/I:C/A:C |
Affected products
- Foscam Foscam Indoor IP Camera C1 Series
Classification
- Weakness
- CWE-287 Improper Authentication
References
- talosintelligence.com /vulnerability_reports/TALOS-2017-0379 · x_refsource_MISC, x_transferred
Sources
- CVE List: CVE-2017-2872
- NVD: CVE-2017-2872
vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.