PT-2018-14784 · Opticam+1 · Opticam I5 Application Firmware+3

Harry Sintonen · Publicado 2018-11-07 · Atualizado 2019-10-03 · CVE-2018-19071

Positive Technologies (AI Summary)

CVSS v3.1

7.8

Alta

Vetor base

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Foscam C2 versions 1.11.1.8 Foscam C2 Application Firmware versions 2.72.1.32 Opticam i5 versions 1.5.2.11 Opticam i5 Application Firmware versions 2.21.1.128

Description An issue was discovered that allows local users to control the commands executed at system start-up due to the /mnt/mtd/boot.sh file having 0777 permissions.

Recommendations For Foscam C2 version 1.11.1.8, change the permissions of the /mnt/mtd/boot.sh file to prevent local users from modifying it. For Foscam C2 Application Firmware version 2.72.1.32, update the firmware to a version that sets proper permissions for the /mnt/mtd/boot.sh file. For Opticam i5 version 1.5.2.11, change the permissions of the /mnt/mtd/boot.sh file to prevent local users from modifying it. For Opticam i5 Application Firmware version 2.21.1.128, update the firmware to a version that sets proper permissions for the /mnt/mtd/boot.sh file.

Exploit

Correção

Incorrect Permission

Enumeração de Fraquezas

CWE-732

Identificadores relacionados

CVE-2018-19071

Produtos afetados

Foscam C2

Foscam C2 Application Firmware

Opticam I5

Opticam I5 Application Firmware

Referências · 3

• 🔥 https://sintonen.fi/advisories/foscam-ip-camera-multiple-vulnerabilities.txt · Exploit
• https://osv.dev/vulnerability/CVE-2018-19071 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2018-19071 · Nota de Segurança