CVE-2017-17105

Critical

Published: 19/12/2017(UTC)Translated: 14/06/2026(UTC)NVD NIST

Summary

Zivif PR115-204-P-RS web cameras in versions V2.3.4.2103 and V4.7.4.2121 (and possibly in between versions) are vulnerable to unauthenticated, blind remote command injection via CGI scripts used in the web interface.

Risk Assessment

An attacker can remotely execute arbitrary commands on the device, potentially leading to loss of control over the camera and network security breaches.

Recommendation

It is recommended to update the camera firmware to the latest version that addresses this vulnerability and to restrict access to the web interface.

Original NVD description (English source)

Zivif PR115-204-P-RS V2.3.4.2103 and V4.7.4.2121 (and possibly in-between versions) web cameras are vulnerable to unauthenticated, blind remote command injection via CGI scripts used as part of the web interface, as demonstrated by a cgi-bin/iptest.cgi?cmd=iptest.cgi&-time="1504225666237"&-url=$(reboot) request.