CVE-2017-8225

Опубликовано: 25 апр. 2017

Источник: nvd

CVSS3: 9.8

CVSS2: 7.5

EPSS Высокий

Описание

On Wireless IP Camera (P2P) WIFICAM devices, access to .ini files (containing credentials) is not correctly checked. An attacker can bypass authentication by providing an empty loginuse parameter and an empty loginpas parameter in the URI.

Ссылки

http://seclists.org/fulldisclosure/2017/Mar/23
Exploit
Mailing List
Third Party Advisory
https://pierrekim.github.io/blog/2017-03-08-camera-goahead-0day.html#pre-auth-info-leak-goahead
Exploit
Third Party Advisory
http://seclists.org/fulldisclosure/2017/Mar/23
Exploit
Mailing List
Third Party Advisory
https://pierrekim.github.io/blog/2017-03-08-camera-goahead-0day.html#pre-auth-info-leak-goahead
Exploit
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

Одновременно

cpe:2.3:o:wificam:wireless_ip_camera_\(p2p\)_firmware:-:*:*:*:*:*:*:*

cpe:2.3:h:wificam:wireless_ip_camera_\(p2p\):-:*:*:*:*:*:*:*

EPSS

Процентиль: 99%

0.70891

Высокий

9.8 Critical

CVSS3

7.5 High

CVSS2

Дефекты

CWE-522

Связанные уязвимости

GHSA-5rv8-75v4-fcqc