CVE-2017-2849
HIGHFoscam C1 Indoor HD Camera Firmware 2.52.2.37 - OS Command Injection via NTP Server Configuration
Title source: llmDescription
In the web management interface in Foscam C1 Indoor HD cameras with application firmware 2.52.2.37, a specially crafted HTTP request can allow for a user to inject arbitrary shell characters during NTP server configuration resulting in command injection. An attacker can simply send an HTTP request to the device to trigger this vulnerability.
References (2)
Core 2
Core References
Broken Link vdb-entry
x_refsource_bid
http://www.securityfocus.com/bid/99184
Technical Description, Third Party Advisory, VDB Entry x_refsource_misc
https://talosintelligence.com/vulnerability_reports/TALOS-2017-0351
Scores
CVSS v3
8.8
EPSS
0.0478
EPSS Percentile
90.8%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Details
CWE
CWE-78
Status
published
Products (2)
foscam/c1_indoor_hd_camera_firmware
2.52.2.37
Foscam/Indoor IP Camera C1 Series
Published
Jun 29, 2017
Tracked Since
Feb 18, 2026