by Kastro
Paper/Archive/CVE-2020-7879

CVE-2020-7879

EFM networks & multimedia ipTIME C200 IP Camera — ipTIME C200 IP Camera command injection vulnerability

EPSS 1%CVSS 9.8
critical.is priorityof 100
44
CVSS 9.8 (NVD)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 73.3.733 × 2014.7No public exploit+100.0SSVC exploitation: unknown+100.0
Description · from the CVE record

This issue was discovered when the ipTIME C200 IP Camera was synchronized with the ipTIME NAS. It is necessary to extract value for ipTIME IP camera because the ipTIME NAS send ans setCookie('[COOKIE]') . The value is transferred to the --header option in wget binary, and there is no validation check. This vulnerability allows remote attackers to execute remote command.

Affected

ProductAffectedFixed inSource
ipTIME C200 IP Camera1.0.16 – 1.0.16–CNA

Scores by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
krcert (CNA)8.8CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

refboho.or.kr/krcert/secNoticeView.do?bulletin_writing_sequence=36365