CVE-2018-17879 Command injection in n/a

Critical 9.8 Published 26 Oct 2023 Updated 5 Aug 2024

Remote attackers can execute arbitrary code as root on ABUS TVIP cameras via command injection in CGI scripts.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2018-17879?

CVE-2018-17879 is a critical command injection vulnerability in n/a, published on 26 Oct 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

An issue was discovered on certain ABUS TVIP cameras. The CGI scripts allow remote attackers to execute code via system() as root. There are several injection points in various scripts.

Weakness: CWE-78

Which versions are affected by CVE-2018-17879?

It affects 47 products.

Products include Abus Tvip 10000 Firmware, Abus Tvip 10001 Firmware, Abus Tvip 10005 Firmware, Abus Tvip 10005a Firmware, Abus Tvip 10005b Firmware, Abus Tvip 10050 Firmware and 41 more.

How do I fix CVE-2018-17879?

No fix has been published for CVE-2018-17879 yet. Limit exposure of the affected software until one is available.

Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.

Is CVE-2018-17879 being exploited?

There is no known exploitation of CVE-2018-17879 in the wild and no public exploit code.

Sources

Also known as GHSA-rgg4-rgq7-84pp.