Vulnerability Report

CVE-2017-2850

RCE

Title: Foscam C1 Indoor Hd Camera RCE

RCE

Proof Of Concept

No public PoC currently indexed for CVE-2017-2850.

CWE Category CWE-78

Published Date Jun 29, 2017

Modified Date Jun 17, 2026

Exploit Status Not Found

Score 8.8 CVSS v3.1

Exploit Probability (EPSS)

2.19%

Vulnerability Summary

CVE-2017-2850: In the web management interface in Foscam C1 Indoor HD cameras with application firmware 2.52.2.37, a specially crafted HTTP request can allow for a user to inject arbitrary characters in the pureftpd.passwd file during a username change, which in turn allows for bypassing chroot restrictions in the FTP server. An attacker can simply send an HTTP request to the device to trigger this vulnerability.

Impacted Vendors

foscam 1

Reference Links

http://www.securityfocus.com/bid/99184 https://talosintelligence.com/vulnerability_reports/TALOS-2017-0352 http://www.securityfocus.com/bid/99184 https://talosintelligence.com/vulnerability_reports/TALOS-2017-0352

CVSS v3.1

Source Entity [email protected]

Severity HIGH

8.8

Attack Vector

NETWORK

Complexity

LOW

Privileges

N/A

Interaction

NONE

Confidentiality

N/A

Integrity

N/A

Availability

N/A

Scope

UNCHANGED

RAW VECTOR CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CVSS v3.0

Source Entity [email protected]

Severity HIGH

8.8

Attack Vector

NETWORK

Complexity

LOW

Privileges

N/A

Interaction

NONE

Confidentiality

N/A

Integrity

N/A

Availability

N/A

Scope

UNCHANGED

RAW VECTOR CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CVSS v2.0

Source Entity [email protected]

Severity MEDIUM

6.5

Access Vector

N/A

Authentication

N/A

RAW VECTOR AV:N/AC:L/Au:S/C:P/I:P/A:P

Associated Attack Patterns (CAPEC)

Total: Patterns