PT-2018-14778 · Foscam+1 · Foscam C2+1

Harry Sintonen · Published 2018-11-07 · Updated 2018-12-11 · CVE-2018-19065

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Foscam C2 versions 1.11.1.8 Foscam C2 Application Firmware versions 2.72.1.32 Opticam i5 versions 1.5.2.11 Opticam i5 Application Firmware versions 2.21.1.128

Description An issue was discovered where the exported device configuration is encrypted with a hardcoded password BpP+2R9*Q in some cases.

Recommendations For Foscam C2 version 1.11.1.8, update the system firmware to remove the hardcoded password. For Foscam C2 Application Firmware version 2.72.1.32, update the application firmware to remove the hardcoded password. For Opticam i5 version 1.5.2.11, update the system firmware to remove the hardcoded password. For Opticam i5 Application Firmware version 2.21.1.128, update the application firmware to remove the hardcoded password.

Exploit

Fix

Using Hardcoded Credentials

Weakness Enumeration

CWE-798

Related Identifiers

CVE-2018-19065

Affected Products

Foscam C2

Opticam I5

References · 3

• 🔥 https://sintonen.fi/advisories/foscam-ip-camera-multiple-vulnerabilities.txt · Exploit
• https://osv.dev/vulnerability/CVE-2018-19065 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-19065 · Security Note