ipTIME C200 IP Camera command injection vulnerability
CVE-2020-7879

8.8HIGH

Key Information:

Vendor

Efm Networks & Multimedia

Status
Iptime C200 Ip Camera
Vendor
CVE Published:
30 November 2021

What is CVE-2020-7879?

This issue was discovered when the ipTIME C200 IP Camera was synchronized with the ipTIME NAS. It is necessary to extract value for ipTIME IP camera because the ipTIME NAS send ans setCookie('[COOKIE]') . The value is transferred to the --header option in wget binary, and there is no validation check. This vulnerability allows remote attackers to execute remote command.

Affected Version(s)

ipTIME C200 IP Camera N/A 1.0.16

References

https://www.boho.or.kr/krcert/secNoticeView.do?bulletin_w...
x_refsource_MISC

CVSS V3.1

Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Adjacent Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.