← Back to CVEs

CVE-2017-2846

HIGH

8.8

Description

In the web management interface in Foscam C1 Indoor HD cameras with application firmware 2.52.2.37, a specially crafted HTTP request can allow for a user to inject arbitrary shell characters during manual network configuration resulting in command injection. An attacker can simply send an HTTP request to the device to trigger this vulnerability.

CVE Details

CVSS v3.1 Score8.8

SeverityHIGH

CVSS VectorCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack VectorNETWORK

ComplexityLOW

Privileges RequiredLOW

User InteractionNONE

Published6/29/2017

Last Modified4/20/2025

Sourcenvd

Honeypot Sightings0

Affected Products

foscam:c1_indoor_hd_camerafoscam:c1_indoor_hd_camera_firmware

Weaknesses (CWE)

CWE-78

References

http://www.securityfocus.com/bid/99184(talos-cna@cisco.com)

https://talosintelligence.com/vulnerability_reports/TALOS-2017-0348(talos-cna@cisco.com)

http://www.securityfocus.com/bid/99184(af854a3a-2127-422b-91ae-364da2661108)

https://talosintelligence.com/vulnerability_reports/TALOS-2017-0348(af854a3a-2127-422b-91ae-364da2661108)

IOC Correlations

No correlations recorded

This product uses data from the NVD API but is not endorsed or certified by the NVD.