Sign-up

ID

VAR-201706-0502


CVE

CVE-2017-2847


TITLE

Foscam C1 Indoor HD Camera Web Command injection vulnerability in management interface

Trust: 0.8

sources: JVNDB: JVNDB-2017-005151

DESCRIPTION

In the web management interface in Foscam C1 Indoor HD cameras with application firmware 2.52.2.37, a specially crafted HTTP request can allow for a user to inject arbitrary shell characters during manual network configuration resulting in command injection. An attacker can simply send an HTTP request to the device to trigger this vulnerability. FoscamC1IndoorHDCamera is a wireless HD IP camera from China Foscam. A security vulnerability exists in the web management interface in FoscamC1IndoorHDCamera using version 2.52.2.37 of the application firmware. Foscam IP Video Camera is prone to multiple command-injection vulnerabilities. Exploiting these issues could allow an attacker to execute arbitrary commands in context of the affected device

Trust: 2.52

sources: NVD: CVE-2017-2847 // JVNDB: JVNDB-2017-005151 // CNVD: CNVD-2017-14062 // BID: 99184 // VULHUB: VHN-111050

IOT TAXONOMY

category:['Network device']sub_category: -

Trust: 0.6

sources: CNVD: CNVD-2017-14062

AFFECTED PRODUCTS

vendor:foscammodel:c1 indoor hd camerascope:eqversion:2.52.2.37

Trust: 2.4

vendor:foscammodel:c1 indoor hd camerasscope:lteversion:<=2.52.2.37

Trust: 0.6

vendor:foscammodel:ip video camerascope:eqversion:1.9.3.17

Trust: 0.3

vendor:foscammodel:ip video camerascope:neversion:2.0.2.43

Trust: 0.3

sources: CNVD: CNVD-2017-14062 // BID: 99184 // JVNDB: JVNDB-2017-005151 // CNNVD: CNNVD-201706-1215 // NVD: CVE-2017-2847

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2017-2847
value: HIGH

Trust: 1.0

talos-cna@cisco.com: CVE-2017-2847
value: HIGH

Trust: 1.0

NVD: CVE-2017-2847
value: HIGH

Trust: 0.8

CNVD: CNVD-2017-14062
value: MEDIUM

Trust: 0.6

CNNVD: CNNVD-201706-1215
value: HIGH

Trust: 0.6

VULHUB: VHN-111050
value: MEDIUM

Trust: 0.1

nvd@nist.gov: CVE-2017-2847
severity: MEDIUM
baseScore: 6.5
vectorString: AV:N/AC:L/AU:S/C:P/I:P/A:P
accessVector: NETWORK
accessComplexity: LOW
authentication: SINGLE
confidentialityImpact: PARTIAL
integrityImpact: PARTIAL
availabilityImpact: PARTIAL
exploitabilityScore: 8.0
impactScore: 6.4
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.8

CNVD: CNVD-2017-14062
severity: MEDIUM
baseScore: 6.5
vectorString: AV:N/AC:L/AU:S/C:P/I:P/A:P
accessVector: NETWORK
accessComplexity: LOW
authentication: SINGLE
confidentialityImpact: PARTIAL
integrityImpact: PARTIAL
availabilityImpact: PARTIAL
exploitabilityScore: 8.0
impactScore: 6.4
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.6

VULHUB: VHN-111050
severity: MEDIUM
baseScore: 6.5
vectorString: AV:N/AC:L/AU:S/C:P/I:P/A:P
accessVector: NETWORK
accessComplexity: LOW
authentication: SINGLE
confidentialityImpact: PARTIAL
integrityImpact: PARTIAL
availabilityImpact: PARTIAL
exploitabilityScore: 8.0
impactScore: 6.4
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.1

talos-cna@cisco.com: CVE-2017-2847
baseSeverity: HIGH
baseScore: 8.8
vectorString: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: 2.8
impactScore: 5.9
version: 3.0

Trust: 1.8

nvd@nist.gov: CVE-2017-2847
baseSeverity: HIGH
baseScore: 8.8
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: 2.8
impactScore: 5.9
version: 3.1

Trust: 1.0

sources: CNVD: CNVD-2017-14062 // VULHUB: VHN-111050 // JVNDB: JVNDB-2017-005151 // CNNVD: CNNVD-201706-1215 // NVD: CVE-2017-2847 // NVD: CVE-2017-2847

PROBLEMTYPE DATA

problemtype:CWE-78

Trust: 1.1

problemtype:CWE-77

Trust: 0.9

sources: VULHUB: VHN-111050 // JVNDB: JVNDB-2017-005151 // NVD: CVE-2017-2847

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-201706-1215

TYPE

operating system commend injection

Trust: 0.6

sources: CNNVD: CNNVD-201706-1215

CONFIGURATIONS

sources:
            
            
            JVNDB: JVNDB-2017-005151

PATCH
title:Top Pageurl:https://www.foscam.com/
Trust: 0.8
title:FoscamC1IndoorHDCameracgiproxy.fcgi-DNS1. Address Configuration Command Injection Vulnerability Patchurl:https://www.cnvd.org.cn/patchInfo/show/97902
Trust: 0.6
title:Foscam C1 Indoor HD Camera Fixes for command injection vulnerabilitiesurl:http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=71353
Trust: 0.6
sources:
            
            
            CNVD: CNVD-2017-14062 // 
            
            
            
            JVNDB: JVNDB-2017-005151 // 
            
            
            
            CNNVD: CNNVD-201706-1215

EXTERNAL IDS
db:NVDid:CVE-2017-2847
Trust: 3.4
db:TALOSid:TALOS-2017-0349
Trust: 3.1
db:BIDid:99184
Trust: 2.6
db:JVNDBid:JVNDB-2017-005151
Trust: 0.8
db:CNNVDid:CNNVD-201706-1215
Trust: 0.7
db:CNVDid:CNVD-2017-14062
Trust: 0.6
db:SEEBUGid:SSVID-96495
Trust: 0.1
db:SEEBUGid:SSVID-96265
Trust: 0.1
db:VULHUBid:VHN-111050
Trust: 0.1
sources:
            
            
            CNVD: CNVD-2017-14062 // 
            
            
            
            VULHUB: VHN-111050 // 
            
            
            
            BID: 99184 // 
            
            
            
            JVNDB: JVNDB-2017-005151 // 
            
            
            
            CNNVD: CNNVD-201706-1215 // 
            
            
            
            NVD: CVE-2017-2847

REFERENCES
url:https://talosintelligence.com/vulnerability_reports/talos-2017-0349
Trust: 2.3
url:http://www.securityfocus.com/bid/99184
Trust: 1.7
url:https://www.talosintelligence.com/vulnerability_reports/talos-2017-0349
Trust: 1.4
url:http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2017-2847
Trust: 0.8
url:https://nvd.nist.gov/vuln/detail/cve-2017-2847
Trust: 0.8
url:http://www.foscam.com/
Trust: 0.3
url:http://blog.talosintelligence.com/2017/06/foscam-vuln-details.html
Trust: 0.3
sources:
            
            
            CNVD: CNVD-2017-14062 // 
            
            
            
            VULHUB: VHN-111050 // 
            
            
            
            BID: 99184 // 
            
            
            
            JVNDB: JVNDB-2017-005151 // 
            
            
            
            CNNVD: CNNVD-201706-1215 // 
            
            
            
            NVD: CVE-2017-2847

CREDITS
Cory Duplantis, Claudio Bozzato and another member of Cisco Talos.
Trust: 0.3
sources:
            
            
            BID: 99184

SOURCES
db:CNVDid:CNVD-2017-14062
db:VULHUBid:VHN-111050
db:BIDid:99184
db:JVNDBid:JVNDB-2017-005151
db:CNNVDid:CNNVD-201706-1215
db:NVDid:CVE-2017-2847

LAST UPDATE DATE
2025-04-20T21:32:50.848000+00:00

SOURCES UPDATE DATE
db:CNVDid:CNVD-2017-14062date:2017-07-12T00:00:00
db:VULHUBid:VHN-111050date:2019-10-03T00:00:00
db:BIDid:99184date:2017-06-19T00:00:00
db:JVNDBid:JVNDB-2017-005151date:2017-07-19T00:00:00
db:CNNVDid:CNNVD-201706-1215date:2022-04-20T00:00:00
db:NVDid:CVE-2017-2847date:2025-04-20T01:37:25.860

SOURCES RELEASE DATE
db:CNVDid:CNVD-2017-14062date:2017-07-12T00:00:00
db:VULHUBid:VHN-111050date:2017-06-29T00:00:00
db:BIDid:99184date:2017-06-19T00:00:00
db:JVNDBid:JVNDB-2017-005151date:2017-07-19T00:00:00
db:CNNVDid:CNNVD-201706-1215date:2017-06-30T00:00:00
db:NVDid:CVE-2017-2847date:2017-06-29T17:29:00.290