Sign-up

ID

VAR-202111-1531


CVE

CVE-2020-7879


TITLE

ipTIME C200 IP  in camera  OS  Command injection vulnerability

Trust: 0.8

sources: JVNDB: JVNDB-2021-015719

DESCRIPTION

This issue was discovered when the ipTIME C200 IP Camera was synchronized with the ipTIME NAS. It is necessary to extract value for ipTIME IP camera because the ipTIME NAS send ans setCookie('[COOKIE]') . The value is transferred to the --header option in wget binary, and there is no validation check. This vulnerability allows remote attackers to execute remote command. ipTIME C200 IP The camera has OS A command injection vulnerability exists.Information is obtained, information is tampered with, and service operation is interrupted. (DoS) It may be in a state

Trust: 1.62

sources: NVD: CVE-2020-7879 // JVNDB: JVNDB-2021-015719

IOT TAXONOMY

category:['camera device']sub_category:IP camera

Trust: 0.1

sources: OTHER: None

AFFECTED PRODUCTS

vendor:iptimemodel:c200scope:lteversion:1.0.16

Trust: 1.0

vendor:iptimemodel:c200scope:eqversion:c200 firmware

Trust: 0.8

vendor:iptimemodel:c200scope:eqversion: -

Trust: 0.8

vendor:iptimemodel:c200scope: - version: -

Trust: 0.8

sources: JVNDB: JVNDB-2021-015719 // NVD: CVE-2020-7879

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2020-7879
value: CRITICAL

Trust: 1.0

vuln@krcert.or.kr: CVE-2020-7879
value: HIGH

Trust: 1.0

NVD: CVE-2020-7879
value: CRITICAL

Trust: 0.8

CNNVD: CNNVD-202111-2372
value: CRITICAL

Trust: 0.6

nvd@nist.gov: CVE-2020-7879
severity: MEDIUM
baseScore: 6.8
vectorString: AV:N/AC:M/AU:N/C:P/I:P/A:P
accessVector: NETWORK
accessComplexity: MEDIUM
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: PARTIAL
availabilityImpact: PARTIAL
exploitabilityScore: 8.6
impactScore: 6.4
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.8

nvd@nist.gov: CVE-2020-7879
baseSeverity: CRITICAL
baseScore: 9.8
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: 3.9
impactScore: 5.9
version: 3.1

Trust: 1.0

vuln@krcert.or.kr: CVE-2020-7879
baseSeverity: HIGH
baseScore: 8.8
vectorString: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
attackVector: ADJACENT
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: 2.8
impactScore: 5.9
version: 3.1

Trust: 1.0

NVD: CVE-2020-7879
baseSeverity: CRITICAL
baseScore: 9.8
vectorString: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: NONE
impactScore: NONE
version: 3.0

Trust: 0.8

sources: JVNDB: JVNDB-2021-015719 // CNNVD: CNNVD-202111-2372 // NVD: CVE-2020-7879 // NVD: CVE-2020-7879

PROBLEMTYPE DATA

problemtype:CWE-78

Trust: 1.0

problemtype:OS Command injection (CWE-78) [NVD evaluation ]

Trust: 0.8

sources: JVNDB: JVNDB-2021-015719 // NVD: CVE-2020-7879

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-202111-2372

TYPE

operating system commend injection

Trust: 0.6

sources: CNNVD: CNNVD-202111-2372

PATCH

title:Top Pageurl:https://iptime.com/iptime/

Trust: 0.8

title:EFM ipTIME C200 IP Camera Fixes for operating system command injection vulnerabilitiesurl:http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=173818

Trust: 0.6

sources: JVNDB: JVNDB-2021-015719 // CNNVD: CNNVD-202111-2372

EXTERNAL IDS

db:NVDid:CVE-2020-7879

Trust: 3.3

db:JVNDBid:JVNDB-2021-015719

Trust: 0.8

db:CNNVDid:CNNVD-202111-2372

Trust: 0.6

db:OTHERid:NONE

Trust: 0.1

sources: OTHER: None // JVNDB: JVNDB-2021-015719 // CNNVD: CNNVD-202111-2372 // NVD: CVE-2020-7879

REFERENCES

url:https://www.boho.or.kr/krcert/secnoticeview.do?bulletin_writing_sequence=36365

Trust: 2.4

url:https://nvd.nist.gov/vuln/detail/cve-2020-7879

Trust: 1.4

url:https://ieeexplore.ieee.org/abstract/document/10769424

Trust: 0.1

sources: OTHER: None // JVNDB: JVNDB-2021-015719 // CNNVD: CNNVD-202111-2372 // NVD: CVE-2020-7879

SOURCES

db:OTHERid: -
db:JVNDBid:JVNDB-2021-015719
db:CNNVDid:CNNVD-202111-2372
db:NVDid:CVE-2020-7879

LAST UPDATE DATE

2025-01-30T22:30:28.367000+00:00


SOURCES UPDATE DATE

db:JVNDBid:JVNDB-2021-015719date:2022-11-29T08:00:00
db:CNNVDid:CNNVD-202111-2372date:2021-12-10T00:00:00
db:NVDid:CVE-2020-7879date:2021-12-01T20:13:30.840

SOURCES RELEASE DATE

db:JVNDBid:JVNDB-2021-015719date:2022-11-29T00:00:00
db:CNNVDid:CNNVD-202111-2372date:2021-11-30T00:00:00
db:NVDid:CVE-2020-7879date:2021-11-30T19:15:08.030