Sign-up

ID

VAR-201906-0716


CVE

CVE-2017-18377


TITLE

Wireless IP Camera WIFICAM Command injection vulnerability in camera

Trust: 0.8

sources: JVNDB: JVNDB-2017-014509

DESCRIPTION

An issue was discovered on Wireless IP Camera (P2P) WIFICAM cameras. There is Command Injection in the set_ftp.cgi script via shell metacharacters in the pwd variable, as demonstrated by a set_ftp.cgi?svr=192.168.1.1&port=21&user=ftp URI. Wireless IP Camera (P2P) WIFICAM The camera contains a command injection vulnerability.Information is obtained, information is altered, and service operation is disrupted (DoS) There is a possibility of being put into a state. WIFICAM is an IP camera. The set_ftp.cgi script in WIFICAM has a command injection vulnerability. This vulnerability stems from the fact that the network system or product does not correctly filter special elements in the process of constructing executable commands from external input data. Attackers can exploit this vulnerability to execute illegal commands

Trust: 1.8

sources: NVD: CVE-2017-18377 // JVNDB: JVNDB-2017-014509 // VULHUB: VHN-109493 // VULMON: CVE-2017-18377

AFFECTED PRODUCTS

vendor:goaheadmodel:wireless ip camera wificamscope:eqversion: -

Trust: 1.0

vendor:wificammodel:wireless ip camera wificamscope: - version: -

Trust: 0.8

sources: JVNDB: JVNDB-2017-014509 // NVD: CVE-2017-18377

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2017-18377
value: CRITICAL

Trust: 1.0

NVD: CVE-2017-18377
value: CRITICAL

Trust: 0.8

CNNVD: CNNVD-201906-402
value: CRITICAL

Trust: 0.6

VULHUB: VHN-109493
value: HIGH

Trust: 0.1

VULMON: CVE-2017-18377
value: HIGH

Trust: 0.1

nvd@nist.gov: CVE-2017-18377
severity: HIGH
baseScore: 10.0
vectorString: AV:N/AC:L/AU:N/C:C/I:C/A:C
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: COMPLETE
integrityImpact: COMPLETE
availabilityImpact: COMPLETE
exploitabilityScore: 10.0
impactScore: 10.0
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.9

VULHUB: VHN-109493
severity: HIGH
baseScore: 10.0
vectorString: AV:N/AC:L/AU:N/C:C/I:C/A:C
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: COMPLETE
integrityImpact: COMPLETE
availabilityImpact: COMPLETE
exploitabilityScore: 10.0
impactScore: 10.0
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.1

nvd@nist.gov: CVE-2017-18377
baseSeverity: CRITICAL
baseScore: 9.8
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: 3.9
impactScore: 5.9
version: 3.1

Trust: 1.0

NVD: CVE-2017-18377
baseSeverity: CRITICAL
baseScore: 9.8
vectorString: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: NONE
impactScore: NONE
version: 3.0

Trust: 0.8

sources: VULHUB: VHN-109493 // VULMON: CVE-2017-18377 // JVNDB: JVNDB-2017-014509 // CNNVD: CNNVD-201906-402 // NVD: CVE-2017-18377

PROBLEMTYPE DATA

problemtype:CWE-77

Trust: 1.9

sources: VULHUB: VHN-109493 // JVNDB: JVNDB-2017-014509 // NVD: CVE-2017-18377

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-201906-402

TYPE

command injection

Trust: 0.6

sources: CNNVD: CNNVD-201906-402

CONFIGURATIONS

sources:
            
            
            JVNDB: JVNDB-2017-014509

PATCH
title:Embedthis GoAhead Community Editionurl:https://github.com/embedthis/goahead
Trust: 0.8
sources:
            
            
            JVNDB: JVNDB-2017-014509

EXTERNAL IDS
db:NVDid:CVE-2017-18377
Trust: 2.6
db:JVNDBid:JVNDB-2017-014509
Trust: 0.8
db:CNNVDid:CNNVD-201906-402
Trust: 0.7
db:VULHUBid:VHN-109493
Trust: 0.1
db:VULMONid:CVE-2017-18377
Trust: 0.1
sources:
            
            
            VULHUB: VHN-109493 // 
            
            
            
            VULMON: CVE-2017-18377 // 
            
            
            
            JVNDB: JVNDB-2017-014509 // 
            
            
            
            CNNVD: CNNVD-201906-402 // 
            
            
            
            NVD: CVE-2017-18377

REFERENCES
url:https://pierrekim.github.io/blog/2017-03-08-camera-goahead-0day.html#pre-auth-root-rce
Trust: 2.6
url:https://nvd.nist.gov/vuln/detail/cve-2017-18377
Trust: 1.4
url:https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2017-18377
Trust: 0.8
url:https://cwe.mitre.org/data/definitions/77.html
Trust: 0.1
url:https://nvd.nist.gov
Trust: 0.1
sources:
            
            
            VULHUB: VHN-109493 // 
            
            
            
            VULMON: CVE-2017-18377 // 
            
            
            
            JVNDB: JVNDB-2017-014509 // 
            
            
            
            CNNVD: CNNVD-201906-402 // 
            
            
            
            NVD: CVE-2017-18377

SOURCES
db:VULHUBid:VHN-109493
db:VULMONid:CVE-2017-18377
db:JVNDBid:JVNDB-2017-014509
db:CNNVDid:CNNVD-201906-402
db:NVDid:CVE-2017-18377

LAST UPDATE DATE
2024-08-14T15:33:57.270000+00:00

SOURCES UPDATE DATE
db:VULHUBid:VHN-109493date:2019-06-12T00:00:00
db:VULMONid:CVE-2017-18377date:2021-06-22T00:00:00
db:JVNDBid:JVNDB-2017-014509date:2019-06-20T00:00:00
db:CNNVDid:CNNVD-201906-402date:2019-06-13T00:00:00
db:NVDid:CVE-2017-18377date:2021-06-22T15:55:23.527

SOURCES RELEASE DATE
db:VULHUBid:VHN-109493date:2019-06-11T00:00:00
db:VULMONid:CVE-2017-18377date:2019-06-11T00:00:00
db:JVNDBid:JVNDB-2017-014509date:2019-06-20T00:00:00
db:CNNVDid:CNNVD-201906-402date:2019-06-11T00:00:00
db:NVDid:CVE-2017-18377date:2019-06-11T21:29:00.473