CVE-2017-2828

HIGH

Foscam C1 Indoor HD Camera Firmware 2.52.2.37 - OS Command Injection via Account Creation

Title source: llm
STIX 2.1

Description

An exploitable command injection vulnerability exists in the web management interface used by the Foscam C1 Indoor HD Camera running application firmware 2.52.2.37. A specially crafted HTTP request can allow for a user to inject arbitrary shell characters during account creation resulting in command injection. An attacker can simply send an HTTP request to the device to trigger this vulnerability.

References (2)

Core 2
Core References
Broken Link vdb-entry x_refsource_bid
http://www.securityfocus.com/bid/99184
Exploit, Third Party Advisory, VDB Entry x_refsource_misc
https://www.talosintelligence.com/vulnerability_reports/TALOS-2017-0329

Scores

CVSS v3 8.8
EPSS 0.0780
EPSS Percentile 93.9%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Details

CWE
CWE-78
Status published
Products (2)
foscam/c1_indoor_hd_camera_firmware 2.52.2.37
Foscam/Indoor IP Camera C1 Series
Published Jun 21, 2017
Tracked Since Feb 18, 2026