CVE Catalog
CVE-2017-8862
CriticalSummary
The webupgrade function on the Cohu 3960HD does not verify the firmware upgrade files, allowing an attacker to upload a specially crafted postinstall.sh file that will be executed with 'root' privileges.
Risk Assessment
The lack of verification for upgrade files poses a serious risk of unauthorized control over the device, potentially leading to significant security breaches.
Recommendation
It is recommended to implement verification mechanisms for upgrade files and restrict access to the upgrade function to trusted users.
Original NVD description (English source)
The webupgrade function on the Cohu 3960HD does not verify the firmware upgrade files or process, allowing an attacker to upload a specially crafted postinstall.sh file that will be executed with "root" privileges.