CVE-2017-5675
HighSummary
A command-injection vulnerability exists in a web application on a custom-built GoAhead web server used on Foscam, Vstarcam, and multiple white-label IP camera models. The mail-sending form in the mail.htm page allows an attacker to inject a command into the receiver1 field in the form; it will be executed with root privileges.
Risk Assessment
This vulnerability could allow an attacker to gain control over the system, posing a serious threat to the security of the organization's data and infrastructure.
Recommendation
It is recommended to update the GoAhead server software and implement appropriate security measures in forms to prevent command injection.
Other vulnerabilities in GoAhead web server
Original NVD description (English source)
A command-injection vulnerability exists in a web application on a custom-built GoAhead web server used on Foscam, Vstarcam, and multiple white-label IP camera models. The mail-sending form in the mail.htm page allows an attacker to inject a command into the receiver1 field in the form; it will be executed with root privileges.