CVE-2017-2877 Missing authorization in Foscam C1 Indoor HD Camera
An unauthenticated attacker can reset user accounts to factory defaults via a crafted request on the Multi-Camera interface.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2017-2877?
CVE-2017-2877 is a critical missing authorization vulnerability in Foscam C1 Indoor HD Camera, published on 19 Sep 2018. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
A missing error check exists in the Multi-Camera interface used by the Foscam C1 Indoor HD Camera running application firmware 2.52.2.43. A specially crafted request on port 10001 could allow an attacker to reset the user accounts to factory defaults, without authentication.
Weakness: CWE-755
Which versions are affected by CVE-2017-2877?
It affects 1 product.
Products include Foscam C1 Firmware.
How do I fix CVE-2017-2877?
No fix has been published for CVE-2017-2877 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2017-2877 being exploited?
There is no known exploitation of CVE-2017-2877 in the wild and no public exploit code.
Other vulnerabilities in Foscam C1 Indoor HD Camera
Sources
Also known as GHSA-98wp-25ph-mf7r.