CVE-2017-2850

HIGH

Foscam C1 Indoor HD Camera Firmware 2.52.2.37 - OS Command Injection via Username Change

Title source: llm
STIX 2.1

Description

In the web management interface in Foscam C1 Indoor HD cameras with application firmware 2.52.2.37, a specially crafted HTTP request can allow for a user to inject arbitrary characters in the pureftpd.passwd file during a username change, which in turn allows for bypassing chroot restrictions in the FTP server. An attacker can simply send an HTTP request to the device to trigger this vulnerability.

References (2)

Core 2
Core References
Broken Link vdb-entry x_refsource_bid
http://www.securityfocus.com/bid/99184
Technical Description, Third Party Advisory, VDB Entry x_refsource_misc
https://talosintelligence.com/vulnerability_reports/TALOS-2017-0352

Scores

CVSS v3 8.8
EPSS 0.0219
EPSS Percentile 80.2%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Details

CWE
CWE-78
Status published
Products (2)
foscam/c1_indoor_hd_camera_firmware 2.52.2.37
Foscam/Indoor IP Camera C1 Series
Published Jun 29, 2017
Tracked Since Feb 18, 2026