CVE-2018-19076

CRITICAL

Opticam i5 and Foscam C2 - Improper Authentication via FTP and RTSP Services

Title source: llm
STIX 2.1

Description

An issue was discovered on Foscam C2 devices with System Firmware 1.11.1.8 and Application Firmware 2.72.1.32, and Opticam i5 devices with System Firmware 1.5.2.11 and Application Firmware 2.21.1.128. The FTP and RTSP services make it easier for attackers to conduct brute-force authentication attacks, because failed-authentication limits apply only to HTTP (not FTP or RTSP).

References (1)

Core 1
Core References

Scores

CVSS v3 9.8
EPSS 0.0185
EPSS Percentile 76.5%
Attack Vector NETWORK
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Details

CWE
CWE-287
Status published
Products (4)
foscam/c2_application_firmware 2.72.1.32
foscam/c2_system_firmware 1.11.1.8
opticam/i5_application_firmware 2.21.1.128
opticam/i5_system_firmware 1.5.2.11
Published Nov 07, 2018
Tracked Since Feb 18, 2026