CVE-2017-5674
Severity Score
9.8
*CVSS v3
Exploit Likelihood
*EPSS
Affected Versions
*CPE
Public Exploits
2
*Multiple Sources
Exploited in Wild
-
*KEV
Decision
-
*SSVC
Descriptions
A vulnerability in a custom-built GoAhead web server used on Foscam, Vstarcam, and multiple white-label IP camera models allows an attacker to craft a malformed HTTP ("GET system.ini HTTP/1.1
" - note the lack of "/" in the path field of the request) request that will disclose the configuration file with the login password.
Una vulnerabilidad en un servidor web GoAhead personalizado que se utiliza en Foscam, Vstarcam y múltiples modelos de cámara IP de marca blanca permite a un atacante crear una solicitud HTTP malformada ("GET system.ini HTTP/1.1
" - note the lack of "/" en el campo de la ruta de la solicitud) que revelará el archivo de configuración con la contraseña de inicio de sesión.
*Credits:
N/A
CVSS Scores
Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality
Integrity
Availability
Attack Vector
Attack Complexity
Authentication
Confidentiality
Integrity
Availability
* Common Vulnerability Scoring System
SSVC
- Decision:-
Exploitation
Automatable
Tech. Impact
* Organization's Worst-case Scenario
Timeline
- 2017-01-31 CVE Reserved
- 2017-03-13 CVE Published
- 2023-04-11 EPSS Updated
- 2024-08-05 CVE Updated
- 2024-08-05 First Exploit
- ---------- Exploited in Wild
- ---------- KEV Due Date
CWE
- CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
CAPEC
References (2)
| URL | Tag | Source |
|---|
| URL | Date | SRC |
|---|---|---|
| https://www.cybereason.com/cve-ip-cameras | 2024-08-05 | |
| https://www.cybereason.com/zero-day-exploits-turn-hundreds-of-thousands-of-ip-cameras-into-iot-botnet-slaves | 2024-08-05 |
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|