CVE-2017-2844

HIGH

Foscam C1 Indoor HD Camera Firmware 2.52.2.37 - OS Command Injection via msmtprc Configuration File

Title source: llm

Description

In the web management interface in Foscam C1 Indoor HD cameras with application firmware 2.52.2.37, a specially crafted HTTP request can allow for a user to inject arbitrary data in the "msmtprc" configuration file resulting in command execution. An attacker can simply send an HTTP request to the device to trigger this vulnerability.

References (2)

Core 2

Core References

Broken Link vdb-entry x_refsource_bid

http://www.securityfocus.com/bid/99184

Technical Description, Third Party Advisory, VDB Entry x_refsource_misc

https://talosintelligence.com/vulnerability_reports/TALOS-2017-0346

Scores

CVSS v3 8.8

EPSS 0.0344

EPSS Percentile 87.5%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Details

CWE

CWE-78

Status published

Products (2)

foscam/c1_indoor_hd_camera_firmware 2.52.2.37

Foscam/Indoor IP Camera C1 Series

Published Jun 29, 2017

Tracked Since Feb 18, 2026