Vulnerability Report

CVE-2016-8731

Title: Foscam C1 Webcam Cross-Site Scripting (XSS)

XSS

Proof Of Concept

No public PoC currently indexed for CVE-2016-8731.

CWE Category CWE-798

Published Date Jun 21, 2017

Modified Date Jun 17, 2026

Exploit Status Not Found

Score 9.8 CVSS v3.1

Exploit Probability (EPSS)

2.65%

Vulnerability Summary

CVE-2016-8731: Hard-coded FTP credentials (r:r) are included in the Foscam C1 running firmware 1.9.1.12. Knowledge of these credentials would allow remote access to any cameras found on the internet that do not have port 50021 blocked by an intermediate device.

Impacted Vendors

foscam 1

Reference Links

http://www.securityfocus.com/bid/99193 https://www.talosintelligence.com/vulnerability_reports/TALOS-2016-0245 http://www.securityfocus.com/bid/99193 https://www.talosintelligence.com/vulnerability_reports/TALOS-2016-0245

CVSS v3.1

Source Entity [email protected]

Severity CRITICAL

9.8

Attack Vector

NETWORK

Complexity

LOW

Privileges

N/A

Interaction

NONE

Confidentiality

N/A

Integrity

N/A

Availability

N/A

Scope

UNCHANGED

RAW VECTOR CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CVSS v3.0

Source Entity [email protected]

Severity CRITICAL

9.8

Attack Vector

NETWORK

Complexity

LOW

Privileges

N/A

Interaction

NONE

Confidentiality

N/A

Integrity

N/A

Availability

N/A

Scope

UNCHANGED

RAW VECTOR CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CVSS v2.0

Source Entity [email protected]

Severity HIGH

7.5

Access Vector

N/A

Authentication

N/A

RAW VECTOR AV:N/AC:L/Au:N/C:P/I:P/A:P

Associated Attack Patterns (CAPEC)

Total: Patterns