CVE-2018-17558 Vulnerability Details

Record summary

CVE-2018-17558 has a selected CVSS score of 9.8 (critical).

Description

Hardcoded manufacturer credentials and an OS command injection vulnerability in the /cgi-bin/mft/ directory on ABUS TVIP TVIP20050 LM.1.6.18, TVIP10051 LM.1.6.18, TVIP11050 MG.1.6.03.05, TVIP20550 LM.1.6.18, TVIP10050 LM.1.6.18, TVIP11550 MG.1.6.03, TVIP21050 MG.1.6.03, and TVIP51550 MG.1.6.03 cameras allow remote attackers to execute code as root.

Description source: CVE List

Exploitation context

CISA SSVC decision

ExploitationNone

AutomatableNo

Technical impactTotal

CISA Coordinator · SSVC 2.0.3 · Evaluated Sep 11, 2024 · Source: CVE List

Affected products and versions

Product	Source	Version range	Status
tvip_72500_firmware Browse abus / tvip_72500_firmware Default status: unknown	CVE List	Before *	affected

References

nvd.nist.gov

https://nvd.nist.gov/vuln/detail/CVE-2018-17558

sec.maride.cc

https://sec.maride.cc/posts/abus

ccc.de

https://www.ccc.de/en/updates/2019/update-nicht-verfugbar-hersteller-nicht-zu-erreichen