CVE-2020-16205 Command injection in G-Cam and G-Code

What is CVE-2020-16205?

CVE-2020-16205 is a high-severity command injection vulnerability in G-Cam and G-Code, published on 14 Aug 2020. An attacker needs administrator access to exploit it, with no action from the victim.

Official description

Using a specially crafted URL command, a remote authenticated user can execute commands as root on the G-Cam and G-Code (Firmware Versions 1.12.0.25 and prior as well as the limited Versions 1.12.13.2 and 1.12.14.5).

Weakness: CWE-78

Which versions are affected by CVE-2020-16205?

It affects 11 products.

Products include Geutebrueck G-Cam Ebc-2110 Firmware, Geutebrueck G-Cam Ebc-2111 Firmware, Geutebrueck G-Cam Efd-2240 Firmware, Geutebrueck G-Cam Efd-2241 Firmware, Geutebrueck G-Cam Efd-2250 Firmware, Geutebrueck G-Cam Ethc-2230 Firmware and 5 more.

How do I fix CVE-2020-16205?

No fix has been published for CVE-2020-16205 yet. Limit exposure of the affected software until one is available.

Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.

Is CVE-2020-16205 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2020-16205 exists.

Public exploit code: 1 Metasploit module.

Other vulnerabilities in G-Cam and G-Code

• CVE-2021-33543 UDP Technology/Geutebrück camera devices: Authentication Bypass Critical 9.8
• CVE-2021-33544 UDP Technology/Geutebrück camera devices: command injection leading to RCE High 7.2
• CVE-2021-33545 UDP Technology/Geutebrück camera devices: Buffer overflow in counter parameter leading to RCE High 7.2
• CVE-2021-33546 UDP Technology/Geutebrück camera devices: Buffer overflow in name parameter leading to RCE High 7.2
• CVE-2021-33547 UDP Technology/Geutebrück camera devices: Buffer overflow in profile parameter leading to RCE High 7.2

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-rmpj-q623-hh55.