CVE-2018-17878 Memory corruption in n/a

Critical 9.8 Published 26 Oct 2023 Updated 5 Aug 2024

Attackers can execute arbitrary code on ABUS TVIP cameras by sending crafted strings that trigger a buffer overflow in the sprintf function.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2018-17878?

CVE-2018-17878 is a critical memory corruption vulnerability in n/a, published on 26 Oct 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Buffer Overflow vulnerability in certain ABUS TVIP cameras allows attackers to gain control of the program via crafted string sent to sprintf() function.

Weakness: CWE-120

Which versions are affected by CVE-2018-17878?

It affects 47 products.

Products include Abus Tvip 10000 Firmware, Abus Tvip 10001 Firmware, Abus Tvip 10005 Firmware, Abus Tvip 10005a Firmware, Abus Tvip 10005b Firmware, Abus Tvip 10050 Firmware and 41 more.

How do I fix CVE-2018-17878?

No fix has been published for CVE-2018-17878 yet. Limit exposure of the affected software until one is available.

Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.

Is CVE-2018-17878 being exploited?

There is no known exploitation of CVE-2018-17878 in the wild and no public exploit code.

Sources

Also known as GHSA-7jxg-pm47-89ph.