CVSS: 5.5EPSS: 0%CPEs: 2EXPL: 0CVE-2024-7616 – Edimax IC-6220DC/IC-5150W ipcam_cgi cgiFormString command injection
https://notcve.org/view.php?id=CVE-2024-7616
A vulnerability was found in Edimax IC-6220DC and IC-5150W up to 3.06. It has been rated as critical. Affected by this issue is the function cgiFormString of the file ipcam_cgi. The manipulation of the argument host leads to command injection. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. • https://vuldb.com/?ctiid.273986 https://vuldb.com/?id.273986 https://vuldb.com/?submit.383845 https://yjz233.notion.site/edimax-IC-5150W-has-command-injection-vulnerability-in-ipcam_cgi-cc72c7b7e2f24ba6a6609b6fcf78df34 https://yjz233.notion.site/edimax-IC-6220DC-has-command-injection-vulnerability-in-ipcam_cgi-2029d67721f2473b8cfce5e286a70307?pvs=4 • CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection') •
CVSS: 8.8EPSS: 0%CPEs: 6EXPL: 2CVE-2018-8072
https://notcve.org/view.php?id=CVE-2018-8072
An issue was discovered on EDIMAX IC-3140W through 3.06, IC-5150W through 3.09, and IC-6220DC through 3.06 devices. The ipcam_cgi binary contains a stack-based buffer overflow that is possible to trigger from a remote unauthenticated /camera-cgi/public/getsysyeminfo.cgi?action=VALUE_HERE HTTP request: if the VALUE_HERE length is more than 0x400 (1024), it is possible to overwrite other values located on the stack due to an incorrect use of the strcpy() function. Se ha descubierto una vulnerabilidad en los dispositivos EDIMAX IC-3140W hasta la versión 3.06, IC-5150W hasta la 3.09 e IC-6220DC hasta la 3.06. El binario ipcam_cgi contiene un desbordamiento de búfer basado en pila que es posible desencadenar desde una petición HTTP remota no autenticada /camera-cgi/public/getsysyeminfo.cgi? • https://gitlab.com/nemux/CVE-2018-8072/blob/master/CVE-2018-8072_PoC.txt https://gitlab.com/nemux/CVE-2018-8072/blob/master/nemux_codemotion_Rome18_cover.pdf https://www.edimax.com/edimax/download/download/data/edimax/uk/download/for_home/home_network_cameras/home_network_cameras_indoor_fixed/ic-3140w https://www.nemux.org/2018/04/24/cve-2018-8072 • CWE-787: Out-of-bounds Write •