CVE-2017-8221
HIGH EXPLOITED IN THE WILDWireless IP Camera (P2P) WIFICAM - Missing Encryption of Sensitive Data via Cleartext UDP Tunnel
Title source: llmExploitation Summary
CVE-2017-8221 has been observed exploited in the wild (reported by VulnCheck KEV, InTheWild.io). EIP tracks 1 public exploit.
AI-analyzed exploit summary This exploit targets a command injection vulnerability in the GoAhead web server used in various IP cameras. It bypasses authentication to extract credentials and then executes arbitrary commands via crafted HTTP requests to the FTP configuration CGI endpoints, resulting in a reverse shell.
Description
Wireless IP Camera (P2P) WIFICAM devices rely on a cleartext UDP tunnel protocol (aka the Cloud feature) for communication between an Android application and a camera device, which allows remote attackers to obtain sensitive information by sniffing the network.
Exploits (1)
This exploit targets a command injection vulnerability in the GoAhead web server used in various IP cameras. It bypasses authentication to extract credentials and then executes arbitrary commands via crafted HTTP requests to the FTP configuration CGI endpoints, resulting in a reverse shell.
References (2)
Scores
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N