Details of VAR-201807-2159

ID

VAR-201807-2159

CVE

CVE-2018-6830

TITLE

plural Foscam Camera Path traversal vulnerability in product firmware

Trust: 0.8

sources: JVNDB: JVNDB-2018-007981

DESCRIPTION

Directory traversal vulnerability in Foscam Cameras C1 Lite V3, and C1 V3 with firmware 2.82.2.33 and earlier, FI9800P V3, FI9803P V4, FI9851P V3, and FI9853EP V2 2.84.2.33 and earlier, FI9816P V3, FI9821EP V2, FI9821P V3, FI9826P V3, and FI9831P V3 2.81.2.33 and earlier, C1, C1 V2, C1 Lite, and C1 Lite V2 2.52.2.47 and earlier, FI9800P, FI9800P V2, FI9803P V2, FI9803P V3, and FI9851P V2 2.54.2.47 and earlier, FI9815P, FI9815P V2, FI9816P, and FI9816P V2, 2.51.2.47 and earlier, R2 and R4 2.71.1.59 and earlier, C2 and FI9961EP 2.72.1.59 and earlier, FI9900EP, FI9900P, and FI9901EP 2.74.1.59 and earlier, FI9928P 2.74.1.58 and earlier, FI9803EP and FI9853EP 2.22.2.31 and earlier, FI9803P and FI9851P 2.24.2.31 and earlier, FI9821P V2, FI9826P V2, FI9831P V2, and FI9821EP 2.21.2.31 and earlier, FI9821W V2, FI9831W, FI9826W, FI9821P, FI9831P, and FI9826P 2.11.1.120 and earlier, FI9818W V2 2.13.2.120 and earlier, FI9805W, FI9804W, FI9804P, FI9805E, and FI9805P 2.14.1.120 and earlier, FI9828P, and FI9828W 2.13.1.120 and earlier, and FI9828P V2 2.11.1.133 and earlier allows remote attackers to delete arbitrary files via a .. (dot dot) in the URI path component. plural Foscam Camera The product contains a path traversal vulnerability.Information may be tampered with. Foscomm (FOSCAM) is a safe living brand under the Shenzhen Foscom Intelligent Technology Co., Ltd., covering network video surveillance products (webcam, hard disk recorder, monitoring kit), video cloud storage services. Any file deletion vulnerability in the Foscom Foscam camera allows an attacker to delete any file in the camera's file system by making a special GET request for the camera's web management interface. are network camera products of China Foscam (FOSCAM) company. A directory traversal vulnerability exists in several Foscam products. An attacker could exploit this vulnerability to delete arbitrary files

Trust: 2.25

sources: NVD: CVE-2018-6830 // JVNDB: JVNDB-2018-007981 // CNVD: CNVD-2018-12144 // VULHUB: VHN-136862

IOT TAXONOMY

category:

['Network device']

sub_category:

Trust: 0.6

sources: CNVD: CNVD-2018-12144

AFFECTED PRODUCTS

vendor:	foscam	model:	fi9828p	scope:	lte	version:	2.11.1.133	Trust: 1.0
vendor:	foscam	model:	fi9851p	scope:	lte	version:	2.54.2.47	Trust: 1.0
vendor:	foscam	model:	fi9803p	scope:	lte	version:	2.24.2.31	Trust: 1.0
vendor:	foscam	model:	fi9853ep	scope:	lte	version:	2.22.2.31	Trust: 1.0
vendor:	foscam	model:	c1 lite	scope:	lte	version:	2.52.2.47	Trust: 1.0
vendor:	foscam	model:	fi9901ep	scope:	lte	version:	2.74.1.59	Trust: 1.0
vendor:	foscam	model:	c1	scope:	lte	version:	2.52.2.47	Trust: 1.0
vendor:	foscam	model:	fi9803p	scope:	lte	version:	2.54.2.47	Trust: 1.0
vendor:	foscam	model:	c2	scope:	lte	version:	2.72.1.59	Trust: 1.0
vendor:	foscam	model:	fi9928p	scope:	lte	version:	2.74.1.58	Trust: 1.0
vendor:	foscam	model:	fi9805p	scope:	lte	version:	2.14.1.120	Trust: 1.0
vendor:	foscam	model:	fi9803ep	scope:	lte	version:	2.22.2.31	Trust: 1.0
vendor:	foscam	model:	fi9831p	scope:	lte	version:	2.11.1.120	Trust: 1.0
vendor:	foscam	model:	fi9826p	scope:	lte	version:	2.11.1.120	Trust: 1.0
vendor:	foscam	model:	fi9821p	scope:	lte	version:	2.11.1.120	Trust: 1.0
vendor:	foscam	model:	fi9826p	scope:	lte	version:	2.21.2.31	Trust: 1.0
vendor:	foscam	model:	r4	scope:	lte	version:	2.71.1.59	Trust: 1.0
vendor:	foscam	model:	fi9831p	scope:	lte	version:	2.21.2.31	Trust: 1.0
vendor:	foscam	model:	fi9821p	scope:	lte	version:	2.21.2.31	Trust: 1.0
vendor:	foscam	model:	fi9800p	scope:	lte	version:	2.81.2.33	Trust: 1.0
vendor:	foscam	model:	fi9831w	scope:	lte	version:	2.11.1.120	Trust: 1.0
vendor:	foscam	model:	c1 lite	scope:	lte	version:	2.82.2.33	Trust: 1.0
vendor:	foscam	model:	c1	scope:	lte	version:	2.82.2.33	Trust: 1.0
vendor:	foscam	model:	fi9900p	scope:	lte	version:	2.74.1.59	Trust: 1.0
vendor:	foscam	model:	fi9828p	scope:	lte	version:	2.13.1.120	Trust: 1.0
vendor:	foscam	model:	fi9804p	scope:	lte	version:	2.14.1.120	Trust: 1.0
vendor:	foscam	model:	fi9821ep	scope:	lte	version:	2.21.2.31	Trust: 1.0
vendor:	foscam	model:	fi9800p	scope:	lte	version:	2.54.2.47	Trust: 1.0
vendor:	foscam	model:	fi9961ep	scope:	lte	version:	2.72.1.59	Trust: 1.0
vendor:	foscam	model:	fi9900ep	scope:	lte	version:	2.74.1.59	Trust: 1.0
vendor:	foscam	model:	r2	scope:	lte	version:	2.71.1.59	Trust: 1.0
vendor:	foscam	model:	fi9818w	scope:	lte	version:	2.13.2.120	Trust: 1.0
vendor:	foscam	model:	fi9828w	scope:	lte	version:	2.13.1.120	Trust: 1.0
vendor:	foscam	model:	fi9805e	scope:	lte	version:	2.14.1.120	Trust: 1.0
vendor:	foscam	model:	fi9821w	scope:	lte	version:	2.11.1.120	Trust: 1.0
vendor:	foscam	model:	fi9826p	scope:	lte	version:	2.81.2.33	Trust: 1.0
vendor:	foscam	model:	fi9831p	scope:	lte	version:	2.81.2.33	Trust: 1.0
vendor:	foscam	model:	fi9821p	scope:	lte	version:	2.81.2.33	Trust: 1.0
vendor:	foscam	model:	fi9815p	scope:	lte	version:	2.51.2.47	Trust: 1.0
vendor:	foscam	model:	fi9821ep	scope:	lte	version:	2.81.2.33	Trust: 1.0
vendor:	foscam	model:	fi9851p	scope:	lte	version:	2.24.2.31	Trust: 1.0
vendor:	foscam	model:	fi9826w	scope:	lte	version:	2.11.1.120	Trust: 1.0
vendor:	foscam	model:	fi9805w	scope:	lte	version:	2.14.1.120	Trust: 1.0
vendor:	foscam	model:	fi9816p	scope:	lte	version:	2.51.2.47	Trust: 1.0
vendor:	foscam	model:	fi9804w	scope:	lte	version:	2.14.1.120	Trust: 1.0
vendor:	foscam	model:	c1 lite	scope:	-	version:	-	Trust: 0.8
vendor:	foscam	model:	c1	scope:	-	version:	-	Trust: 0.8
vendor:	foscam	model:	c2	scope:	-	version:	-	Trust: 0.8
vendor:	foscam	model:	fi9800p	scope:	-	version:	-	Trust: 0.8
vendor:	foscam	model:	fi9900p	scope:	-	version:	-	Trust: 0.8
vendor:	foscam	model:	r2	scope:	-	version:	-	Trust: 0.8
vendor:	foscam	model:	r4	scope:	-	version:	-	Trust: 0.8
vendor:	foscam	model:	foscam	scope:	-	version:	-	Trust: 0.6
vendor:	foscam	model:	fi9804w	scope:	eq	version:	2.14.1.120	Trust: 0.6
vendor:	foscam	model:	fi9805w	scope:	eq	version:	2.14.1.120	Trust: 0.6
vendor:	foscam	model:	fi9828p	scope:	eq	version:	2.13.1.120	Trust: 0.6
vendor:	foscam	model:	fi9804p	scope:	eq	version:	2.14.1.120	Trust: 0.6
vendor:	foscam	model:	fi9828w	scope:	eq	version:	2.13.1.120	Trust: 0.6
vendor:	foscam	model:	fi9805p	scope:	eq	version:	2.14.1.120	Trust: 0.6
vendor:	foscam	model:	fi9828p	scope:	eq	version:	2.11.1.133	Trust: 0.6
vendor:	foscam	model:	fi9805e	scope:	eq	version:	2.14.1.120	Trust: 0.6
vendor:	foscam	model:	fi9826p	scope:	eq	version:	2.11.1.120	Trust: 0.6
vendor:	foscam	model:	fi9818w	scope:	eq	version:	2.13.2.120	Trust: 0.6

sources: CNVD: CNVD-2018-12144 // JVNDB: JVNDB-2018-007981 // CNNVD: CNNVD-201807-497 // NVD: CVE-2018-6830

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov:	CVE-2018-6830
value:	HIGH
Trust: 1.0
NVD:	CVE-2018-6830
value:	HIGH
Trust: 0.8
CNVD:	CNVD-2018-12144
value:	HIGH
Trust: 0.6
CNNVD:	CNNVD-201807-497
value:	MEDIUM
Trust: 0.6
VULHUB:	VHN-136862
value:	MEDIUM
Trust: 0.1

nvd@nist.gov:	CVE-2018-6830
severity:	MEDIUM
baseScore:	6.4
vectorString:	AV:N/AC:L/AU:N/C:N/I:P/A:P
accessVector:	NETWORK
accessComplexity:	LOW
authentication:	NONE
confidentialityImpact:	NONE
integrityImpact:	PARTIAL
availabilityImpact:	PARTIAL
exploitabilityScore:	10.0
impactScore:	4.9
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 1.8
CNVD:	CNVD-2018-12144
severity:	HIGH
baseScore:	7.8
vectorString:	AV:N/AC:L/AU:N/C:N/I:C/A:N
accessVector:	NETWORK
accessComplexity:	LOW
authentication:	NONE
confidentialityImpact:	NONE
integrityImpact:	COMPLETE
availabilityImpact:	NONE
exploitabilityScore:	10.0
impactScore:	6.9
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 0.6
VULHUB:	VHN-136862
severity:	MEDIUM
baseScore:	6.4
vectorString:	AV:N/AC:L/AU:N/C:N/I:P/A:P
accessVector:	NETWORK
accessComplexity:	LOW
authentication:	NONE
confidentialityImpact:	NONE
integrityImpact:	PARTIAL
availabilityImpact:	PARTIAL
exploitabilityScore:	10.0
impactScore:	4.9
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 0.1

nvd@nist.gov:	CVE-2018-6830
baseSeverity:	HIGH
baseScore:	7.5
vectorString:	CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
attackVector:	NETWORK
attackComplexity:	LOW
privilegesRequired:	NONE
userInteraction:	NONE
scope:	UNCHANGED
confidentialityImpact:	NONE
integrityImpact:	HIGH
availabilityImpact:	NONE
exploitabilityScore:	3.9
impactScore:	3.6
version:	3.0
Trust: 1.8

sources: CNVD: CNVD-2018-12144 // VULHUB: VHN-136862 // JVNDB: JVNDB-2018-007981 // CNNVD: CNNVD-201807-497 // NVD: CVE-2018-6830

PROBLEMTYPE DATA

problemtype:

CWE-22

Trust: 1.9

sources: VULHUB: VHN-136862 // JVNDB: JVNDB-2018-007981 // NVD: CVE-2018-6830

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-201807-497

TYPE

path traversal

Trust: 0.6

sources: CNNVD: CNNVD-201807-497

CONFIGURATIONS

sources: JVNDB: JVNDB-2018-007981

PATCH

title:	Securing Your Foscam Camera - Important Notice	url:	https://www.foscam.com/company/securing-your-foscam-camera-important-notice.html	Trust: 0.8
title:	Foscom Foscam camera arbitrary file removal vulnerability patch	url:	https://www.cnvd.org.cn/patchInfo/show/132887	Trust: 0.6
title:	Multiple Foscam Product path traversal vulnerability fixes	url:	http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=81884	Trust: 0.6

sources: CNVD: CNVD-2018-12144 // JVNDB: JVNDB-2018-007981 // CNNVD: CNNVD-201807-497

EXTERNAL IDS

db:	NVD	id:	CVE-2018-6830	Trust: 3.1
db:	JVNDB	id:	JVNDB-2018-007981	Trust: 0.8
db:	CNNVD	id:	CNNVD-201807-497	Trust: 0.7
db:	CNVD	id:	CNVD-2018-12144	Trust: 0.6
db:	VULHUB	id:	VHN-136862	Trust: 0.1

sources: CNVD: CNVD-2018-12144 // VULHUB: VHN-136862 // JVNDB: JVNDB-2018-007981 // CNNVD: CNNVD-201807-497 // NVD: CVE-2018-6830

REFERENCES

url:	https://blog.vdoo.com/2018/06/06/vdoo-has-found-major-vulnerabilities-in-foscam-cameras/	Trust: 2.3
url:	https://www.foscam.com/company/securing-your-foscam-camera-important-notice.html	Trust: 1.7
url:	https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2018-6830	Trust: 0.8
url:	https://nvd.nist.gov/vuln/detail/cve-2018-6830	Trust: 0.8

sources: CNVD: CNVD-2018-12144 // VULHUB: VHN-136862 // JVNDB: JVNDB-2018-007981 // CNNVD: CNNVD-201807-497 // NVD: CVE-2018-6830

SOURCES

db:	CNVD	id:	CNVD-2018-12144
db:	VULHUB	id:	VHN-136862
db:	JVNDB	id:	JVNDB-2018-007981
db:	CNNVD	id:	CNNVD-201807-497
db:	NVD	id:	CVE-2018-6830

LAST UPDATE DATE

2024-11-23T22:06:39.728000+00:00

SOURCES UPDATE DATE

db:	CNVD	id:	CNVD-2018-12144	date:	2018-06-27T00:00:00
db:	VULHUB	id:	VHN-136862	date:	2018-09-10T00:00:00
db:	JVNDB	id:	JVNDB-2018-007981	date:	2018-10-04T00:00:00
db:	CNNVD	id:	CNNVD-201807-497	date:	2018-07-10T00:00:00
db:	NVD	id:	CVE-2018-6830	date:	2024-11-21T04:11:15.567

SOURCES RELEASE DATE

db:	CNVD	id:	CNVD-2018-12144	date:	2018-06-27T00:00:00
db:	VULHUB	id:	VHN-136862	date:	2018-07-09T00:00:00
db:	JVNDB	id:	JVNDB-2018-007981	date:	2018-10-04T00:00:00
db:	CNNVD	id:	CNNVD-201807-497	date:	2018-07-10T00:00:00
db:	NVD	id:	CVE-2018-6830	date:	2018-07-09T17:29:00.213