PT-2018-14777 · Opticam+1 · Opticam I5 Application Firmware+3

Publicado 2018-11-07 · Atualizado 2019-10-03 · CVE-2018-19064

Positive Technologies (AI Summary)

CVSS v3.1

10

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Foscam C2 versions 1.11.1.8 Foscam C2 Application Firmware versions 2.72.1.32 Opticam i5 versions 1.5.2.11 Opticam i5 Application Firmware versions 2.21.1.128

Description An issue was discovered where the ftpuser1 account has a blank password that cannot be changed.

Recommendations For Foscam C2 version 1.11.1.8, consider disabling the ftpuser1 account until a patch is available. For Foscam C2 Application Firmware version 2.72.1.32, restrict access to the ftpuser1 account to minimize the risk of exploitation. For Opticam i5 version 1.5.2.11, avoid using the ftpuser1 account in sensitive operations until the issue is resolved. For Opticam i5 Application Firmware version 2.21.1.128, limit the privileges of the ftpuser1 account as a temporary mitigation measure.

Exploit

Correção

Enumeração de Fraquezas

CWE-521

Identificadores relacionados

CVE-2018-19064

Produtos afetados

Foscam C2

Foscam C2 Application Firmware

Opticam I5

Opticam I5 Application Firmware

Referências · 3

• 🔥 https://sintonen.fi/advisories/foscam-ip-camera-multiple-vulnerabilities.txt · Exploit
• https://osv.dev/vulnerability/CVE-2018-19064 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2018-19064 · Nota de Segurança