CVE-2020-7879 - ipTIME C200 IP Camera command injection vulnerability

Back Back to CVE browser

CRITICAL

ipTIME C200 IP Camera command injection vulnerability

Published Nov 30, 2021

9.8

CRITICAL

CVSS 3.1

EPSS 1.45%

Description

This issue was discovered when the ipTIME C200 IP Camera was synchronized with the ipTIME NAS. It is necessary to extract value for ipTIME IP camera because the ipTIME NAS send ans setCookie('[COOKIE]') . The value is transferred to the --header option in wget binary, and there is no validation check. This vulnerability allows remote attackers to execute remote command.

Affected products

Vendor EFM networks & multimedia Product ipTIME C200 IP Camera Default
n/a
- Version
  1.0.16
  Status
  affected
  Constraints
  <=1.0.16

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

EFM networks & multimedia

ipTIME C200 IP Camera

n/a

Version	Status	Constraints
1.0.16	affected	<=1.0.16

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-78

OS Command Injection

References (2)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2020-28811
Advisory
https://www.boho.or.kr/krcert/secNoticeView.do?bulletin_writing_sequence=36365
x_refsource_MISCThird Party Advisory

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2020-28811		Advisory
https://www.boho.or.kr/krcert/secNoticeView.do?bulletin_writing_sequence=36365		x_refsource_MISCThird Party Advisory