PT-2018-14794 · Foscam · Foscam Opticam I5

Publicado 2018-11-07 · Atualizado 2018-12-13 · CVE-2018-19081

Positive Technologies (AI Summary)

CVSS v2.0

10

Crítica

Vetor base

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Foscam Opticam i5 devices with System Firmware 1.5.2.11 and Application Firmware 2.21.1.128

Description An issue was discovered that allows remote attackers to execute arbitrary OS commands. This is achieved through the ONVIF devicemgmt SetDNS method, specifically by exploiting the IPv4Address field.

Recommendations For Foscam Opticam i5 devices with System Firmware 1.5.2.11 and Application Firmware 2.21.1.128, consider restricting access to the ONVIF devicemgmt SetDNS method until a patch is available. As a temporary workaround, avoid using the IPv4Address field in the SetDNS method to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this issue.

Exploit

Correção

OS Command Injection

Enumeração de Fraquezas

CWE-78

Identificadores relacionados

CVE-2018-19081

Produtos afetados

Foscam Opticam I5

Referências · 3

• 🔥 https://sintonen.fi/advisories/foscam-ip-camera-multiple-vulnerabilities.txt · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2018-19081 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2018-19081 · Aviso do Fabricante