Command Injection Vulnerability in Vivotek IB8367A Camera

CVE-2024-7443

What is CVE-2024-7443?

A serious security flaw has been identified in the Vivotek IB8367A IP camera model, specifically within the upload_file.cgi function. This vulnerability allows an attacker to manipulate the QUERY_STRING argument, leading to potential command injection. As the affected version (VVTK-0100b) has reached its end-of-life status and is no longer supported by Vivotek, users are highly encouraged to migrate to supported alternatives to mitigate the risk of remote exploitations, which can compromise device integrity and expose sensitive information.

References