Command Injection in EFM ipTIME C200 IP Camera
CVE-2020-7848

8HIGH

Key Information:

Vendor

Efm Networks & Multimedia

Status
Iptime C200 Ip Camera
Vendor
CVE Published:
17 February 2021

What is CVE-2020-7848?

The EFM ipTIME C200 IP Camera has a command injection vulnerability found in the /login.cgi?logout=1 script. This flaw allows attackers to send specially crafted GET requests that can execute arbitrary operating system commands by manipulating cookie values. This vulnerability poses significant security risks, enabling attackers to take control of the affected device remotely.

Affected Version(s)

ipTIME C200 IP Camera Windows 1.0.12

References

https://www.boho.or.kr/krcert/secNoticeView.do?bulletin_w...
x_refsource_MISC

CVSS V3.1

Score:
8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Adjacent Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.