CVE-2008-5674
published 2008-12-19CVE-2008-5674: Multiple array index errors in the HTTP server in Darkwet Network webcamXP 3.72.440.0 and earlier and beta 4.05.280 and earlier allow remote attackers to cause…
PriorityP342critical9.4CVSS 2.0
AVNACLAuNCCINAC
EXPLOIT
EPSS
4.51%
90.3th percentile
Multiple array index errors in the HTTP server in Darkwet Network webcamXP 3.72.440.0 and earlier and beta 4.05.280 and earlier allow remote attackers to cause a denial of service (device crash) and read portions of memory via (1) an invalid camnum parameter to the pocketpc component and (2) an invalid id parameter to the show_gallery_pic component.
Affected
6 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| darkwet | webcam_xp | <= 3.72.440.0 | — |
| darkwet | webcam_xp | — | — |
| darkwet | webcam_xp | — | — |
| darkwet | webcam_xp | — | — |
| darkwet | webcam_xp | — | — |
| darkwet | webcam_xp | — | — |
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
No detection rules found.
Exploit-DB
WebcamXP 3.72.440/4.05.280 Beta - '/show_gallery_pic?id' Arbitrary Memory Disclosure
exploitdb·2008-02-18
CVE-2008-5674 WebcamXP 3.72.440/4.05.280 Beta - '/show_gallery_pic?id' Arbitrary Memory Disclosure
WebcamXP 3.72.440/4.05.280 Beta - '/show_gallery_pic?id' Arbitrary Memory Disclosure
---
source: https://www.securityfocus.com/bid/27875/info
webcamXP is prone to multiple information-disclosure and denial-of-service vulnerabilities because it fails to check user-supplied input data.
Attackers can exploit these issues to access potentially sensitive information or crash the application. Successful exploits could aid in further attacks or deny service to legitimate users.
These issues affect webcamXP 3.72.440 and 4.05.280 beta and prior versions.
http://www.example.com:8080/show_gallery_pic?id=999999
Exploit-DB
WebcamXP 3.72.440/4.05.280 Beta - '/pocketpc?camnum' Arbitrary Memory Disclosure
exploitdb·2008-02-18
CVE-2008-5674 WebcamXP 3.72.440/4.05.280 Beta - '/pocketpc?camnum' Arbitrary Memory Disclosure
WebcamXP 3.72.440/4.05.280 Beta - '/pocketpc?camnum' Arbitrary Memory Disclosure
---
source: https://www.securityfocus.com/bid/27875/info
webcamXP is prone to multiple information-disclosure and denial-of-service vulnerabilities because it fails to check user-supplied input data.
Attackers can exploit these issues to access potentially sensitive information or crash the application. Successful exploits could aid in further attacks or deny service to legitimate users.
These issues affect webcamXP 3.72.440 and 4.05.280 beta and prior versions.
http://www.example.com:8080/pocketpc?camnum=999999&mode=0
http://www.example.com:8080/pocketpc?camnum=-999999&mode=0
No writeups or analysis indexed.
http://aluigi.altervista.org/adv/webcamxp-adv.txthttp://osvdb.org/42929http://secunia.com/advisories/29007http://securityreason.com/securityalert/4788http://www.osvdb.org/42927http://www.osvdb.org/42928http://www.securityfocus.com/archive/1/488364/100/200/threadedhttp://www.securityfocus.com/bid/27875http://aluigi.altervista.org/adv/webcamxp-adv.txthttp://osvdb.org/42929http://secunia.com/advisories/29007http://securityreason.com/securityalert/4788http://www.osvdb.org/42927http://www.osvdb.org/42928http://www.securityfocus.com/archive/1/488364/100/200/threadedhttp://www.securityfocus.com/bid/27875
2008-12-19
Published