PT-2017-9770 · Foscam · Foscam C1

Published 2017-06-21 · Updated 2022-12-14 · CVE-2016-8731

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Foscam C1 version 1.9.1.12

Description The issue concerns hard-coded FTP credentials, specifically r:r, included in the firmware. This could allow remote access to cameras connected to the internet without port 50021 blocked by an intermediate device.

Recommendations For Foscam C1 version 1.9.1.12, consider blocking port 50021 to prevent unauthorized access until a firmware update is available that removes the hard-coded credentials.

Fix

Using Hardcoded Credentials

Weakness Enumeration

CWE-798

Related Identifiers

CVE-2016-8731

Affected Products

Foscam C1

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2016-8731 · Security Note
• https://osv.dev/vulnerability/CVE-2016-8731 · Vendor Advisory
• https://talosintelligence.com/vulnerability_reports/TALOS-2016-0245 · Note
• http://securityfocus.com/bid/99193 · Note