Unauthenticated SQL Injection in Faleemi FSC-880 Devices

CVE-2017-14743

What is CVE-2017-14743?

The Faleemi FSC-880 devices are susceptible to an unauthenticated SQL injection vulnerability through the Username element in an XML document sent to the /onvif/device_service endpoint. An attacker can exploit this flaw to access sensitive information, such as the administrator password, thereby compromising the security of the device and the network it operates on. This issue highlights the critical need for robust input validation in Internet of Things (IoT) devices to prevent unauthorized access.

References