CVE-2020-36885
CriticalSummary
Sony IPELA Network Camera 1.82.01 contains a stack buffer overflow vulnerability in the ftpclient.cgi endpoint that allows remote attackers to execute arbitrary code. Attackers can exploit the vulnerability by sending a crafted POST request with oversized data to the FTP client functionality, potentially causing remote code execution or denial of service.
Risk Assessment
The risk to the organization is remote takeover of the IP camera, potentially compromising privacy and integrity of surveillance, and causing service disruptions.
Recommendation
It is recommended to update the camera firmware to the latest version and restrict access to FTP functionality from external networks.
Original NVD description (English source)
Sony IPELA Network Camera 1.82.01 contains a stack buffer overflow vulnerability in the ftpclient.cgi endpoint that allows remote attackers to execute arbitrary code. Attackers can exploit the vulnerability by sending a crafted POST request with oversized data to the FTP client functionality, potentially causing remote code execution or denial of service.