CVE-2017-9829

High

Published: 23/06/2017(UTC)Translated: 15/06/2026(UTC)NVD NIST

Summary

'/cgi-bin/admin/downloadMedias.cgi' of the web service in most VIVOTEK Network Cameras is vulnerable, allowing remote attackers to read any file on the camera's Linux filesystem via a crafted HTTP request containing '..' sequences.

Risk Assessment

This vulnerability may lead to the exposure of sensitive data stored on the camera, posing a significant security threat to the organization.

Recommendation

It is recommended to update the camera firmware to the latest version to mitigate this vulnerability and restrict access to the administrative interface to trusted users.

Other vulnerabilities in VIVOTEK Network Cameras (IB8369, FD8164, FD816BA oraz inne z podobnym oprogramowaniem)

CVE-2017-9828Critical
'/cgi-bin/admin/testserver.cgi' of the web service in most VIVOTEK Network Cameras is vulnerable to shell command injection, allowing remote attackers to execute any shell command as root via a crafted HTTP request.

Original NVD description (English source)

'/cgi-bin/admin/downloadMedias.cgi' of the web service in most of the VIVOTEK Network Cameras is vulnerable, which allows remote attackers to read any file on the camera's Linux filesystem via a crafted HTTP request containing ".." sequences. This vulnerability is already verified on VIVOTEK Network Camera IB8369/FD8164/FD816BA; most others have similar firmware that may be affected.