/cgi-bin/wapopen in Boa 0.94.14rc21 allows the injection of "../.." using the FILECAMERA variable (sent by GET) to read files with root pri…

Published 9 y ago 2017-06-24 · modified 4 mo ago 2026-06-17 · JSON

CVSS

7.5

v3.1 · NVD

CISA KEV

not known exploited

EPSS

68.5%

percentile 99%

Public exploits

Exploit-DB · Nuclei check

/cgi-bin/wapopen in Boa 0.94.14rc21 allows the injection of "../.." using the FILECAMERA variable (sent by GET) to read files with root privileges. NOTE: multiple third parties report that this is a system-integrator issue (e.g., a vulnerability on one type of camera) because Boa does not include any wapopen program or any code to read a FILECAMERA variable.

Exploit prediction (EPSS)

68.46% probability of exploitation in the next 30 days, higher than 99% of all scored CVEs.

Exploits and detections

Nuclei template BOA Web Server 0.94.14 - Arbitrary File Access · nuclei detection template
EDB-42290 BOA Web Server 0.94.14rc21 - Arbitrary File Access · webapps · 2017-06-20

CVSS scores

Assigned by	Version	Score	Vector
NVD	3.1	7.5	`CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N`
NVD	2.0	7.8	`AV:N/AC:L/Au:N/C:C/I:N/A:N`

Classification

Weakness

CWE-22 Improper Limitation of a Pathname to a Restricted Directory

References

pastebin.com /raw/rt7LJvyF · x_transferred
exploit-db.com /exploits/42290/ · exploit, x_transferred

Sources

CVE List: CVE-2017-9833
NVD: CVE-2017-9833

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.