CVE-2017-9828 Command injection in n/a
Remote attackers can execute arbitrary shell commands as root on VIVOTEK network cameras via a crafted HTTP request to the admin test server.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2017-9828?
CVE-2017-9828 is a critical command injection vulnerability in n/a, published on 23 Jun 2017. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
'/cgi-bin/admin/testserver.cgi' of the web service in most of the VIVOTEK Network Cameras is vulnerable to shell command injection, which allows remote attackers to execute any shell command as root via a crafted HTTP request. This vulnerability is already verified on VIVOTEK Network Camera IB8369/FD8164/FD816BA; most others have similar firmware that may be affected. An attack uses shell metacharacters in the senderemail parameter.
Weakness: CWE-78
Which versions are affected by CVE-2017-9828?
It affects 3 products.
Products include Vivotek Network Camera Fd8164 Firmware, Vivotek Network Camera Fd816ba Firmware, Vivotek Network Camera Ib8369 Firmware.
How do I fix CVE-2017-9828?
No fix has been published for CVE-2017-9828 yet. Limit exposure of the affected software until one is available.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2017-9828 being exploited?
There is no known exploitation of CVE-2017-9828 in the wild and no public exploit code.
Other vulnerabilities in n/a
Sources
Also known as GHSA-mcp7-747p-3h68.