Foscam C2 Application Firmware vulnerabilities

CVE-2018-19081 [CRITICAL] CWE-78 CVE-2018-19081: An issue was discovered on Foscam Opticam i5 devices with System Firmware 1.5.2.11 and Application F An issue was discovered on Foscam Opticam i5 devices with System Firmware 1.5.2.11 and Application Firmware 2.21.1.128. The ONVIF devicemgmt SetDNS method allows remote attackers to execute arbitrary OS commands via the IPv4Address field.

CVE-2018-19064 [CRITICAL] CWE-521 CVE-2018-19064: An issue was discovered on Foscam C2 devices with System Firmware 1.11.1.8 and Application Firmware An issue was discovered on Foscam C2 devices with System Firmware 1.11.1.8 and Application Firmware 2.72.1.32, and Opticam i5 devices with System Firmware 1.5.2.11 and Application Firmware 2.21.1.128. The ftpuser1 account has a blank password, which cannot be changed.

CVE-2018-19067 [CRITICAL] CWE-798 CVE-2018-19067: An issue was discovered on Foscam C2 devices with System Firmware 1.11.1.8 and Application Firmware An issue was discovered on Foscam C2 devices with System Firmware 1.11.1.8 and Application Firmware 2.72.1.32, and Opticam i5 devices with System Firmware 1.5.2.11 and Application Firmware 2.21.1.128. There is a hardcoded Ak47@99 password for the factory~ account.

CVE-2018-19063 [CRITICAL] CWE-798 CVE-2018-19063: An issue was discovered on Foscam C2 devices with System Firmware 1.11.1.8 and Application Firmware An issue was discovered on Foscam C2 devices with System Firmware 1.11.1.8 and Application Firmware 2.72.1.32, and Opticam i5 devices with System Firmware 1.5.2.11 and Application Firmware 2.21.1.128. The admin account has a blank password.

CVE-2018-19069 [CRITICAL] CWE-798 CVE-2018-19069: An issue was discovered on Foscam C2 devices with System Firmware 1.11.1.8 and Application Firmware An issue was discovered on Foscam C2 devices with System Firmware 1.11.1.8 and Application Firmware 2.72.1.32, and Opticam i5 devices with System Firmware 1.5.2.11 and Application Firmware 2.21.1.128. The CGIProxy.fcgi?cmd=setTelnetSwitch feature is authorized for the root user with a password of toor.

CVE-2018-19082 [CRITICAL] CWE-787 CVE-2018-19082: An issue was discovered on Foscam Opticam i5 devices with System Firmware 1.5.2.11 and Application F An issue was discovered on Foscam Opticam i5 devices with System Firmware 1.5.2.11 and Application Firmware 2.21.1.128. The ONVIF devicemgmt SetDNS method allows remote attackers to conduct stack-based buffer overflow attacks via the IPv4Address field.

CVE-2018-19076 [CRITICAL] CWE-287 CVE-2018-19076: An issue was discovered on Foscam C2 devices with System Firmware 1.11.1.8 and Application Firmware An issue was discovered on Foscam C2 devices with System Firmware 1.11.1.8 and Application Firmware 2.72.1.32, and Opticam i5 devices with System Firmware 1.5.2.11 and Application Firmware 2.21.1.128. The FTP and RTSP services make it easier for attackers to conduct brute-force authentication attacks, because failed-authentication limits apply only

CVE-2018-19078 [CRITICAL] CWE-522 CVE-2018-19078: An issue was discovered on Foscam Opticam i5 devices with System Firmware 1.5.2.11 and Application F An issue was discovered on Foscam Opticam i5 devices with System Firmware 1.5.2.11 and Application Firmware 2.21.1.128. The response to an ONVIF media GetStreamUri request contains the administrator username and password.

CVE-2018-19070 [HIGH] CWE-78 CVE-2018-19070: An issue was discovered on Foscam C2 devices with System Firmware 1.11.1.8 and Application Firmware An issue was discovered on Foscam C2 devices with System Firmware 1.11.1.8 and Application Firmware 2.72.1.32, and Opticam i5 devices with System Firmware 1.5.2.11 and Application Firmware 2.21.1.128. They allow remote attackers to execute arbitrary OS commands via shell metacharacters in the usrName parameter of a CGIProxy.fcgi addAccount action.

CVE-2018-19073 [HIGH] CWE-78 CVE-2018-19073: An issue was discovered on Foscam C2 devices with System Firmware 1.11.1.8 and Application Firmware An issue was discovered on Foscam C2 devices with System Firmware 1.11.1.8 and Application Firmware 2.72.1.32, and Opticam i5 devices with System Firmware 1.5.2.11 and Application Firmware 2.21.1.128. They allow attackers to execute arbitrary OS commands via shell metacharacters in the modelName, by leveraging /mnt/mtd/app/config/ProductConfig.xml write

CVE-2018-19065 [HIGH] CWE-798 CVE-2018-19065: An issue was discovered on Foscam C2 devices with System Firmware 1.11.1.8 and Application Firmware An issue was discovered on Foscam C2 devices with System Firmware 1.11.1.8 and Application Firmware 2.72.1.32, and Opticam i5 devices with System Firmware 1.5.2.11 and Application Firmware 2.21.1.128. The exported device configuration is encrypted with the hardcoded BpP+2R9*Q password in some cases.

CVE-2018-19066 [HIGH] CWE-798 CVE-2018-19066: An issue was discovered on Foscam C2 devices with System Firmware 1.11.1.8 and Application Firmware An issue was discovered on Foscam C2 devices with System Firmware 1.11.1.8 and Application Firmware 2.72.1.32, and Opticam i5 devices with System Firmware 1.5.2.11 and Application Firmware 2.21.1.128. The exported device configuration is encrypted with the hardcoded Pxift* password in some cases.

CVE-2018-19079 [HIGH] CWE-306 CVE-2018-19079: An issue was discovered on Foscam Opticam i5 devices with System Firmware 1.5.2.11 and Application F An issue was discovered on Foscam Opticam i5 devices with System Firmware 1.5.2.11 and Application Firmware 2.21.1.128. The ONVIF devicemgmt SystemReboot method allows unauthenticated reboot.

CVE-2018-19074 [HIGH] CVE-2018-19074: An issue was discovered on Foscam C2 devices with System Firmware 1.11.1.8 and Application Firmware An issue was discovered on Foscam C2 devices with System Firmware 1.11.1.8 and Application Firmware 2.72.1.32, and Opticam i5 devices with System Firmware 1.5.2.11 and Application Firmware 2.21.1.128. The firewall has no effect except for blocking port 443 and partially blocking port 88.

CVE-2018-19071 [HIGH] CWE-732 CVE-2018-19071: An issue was discovered on Foscam C2 devices with System Firmware 1.11.1.8 and Application Firmware An issue was discovered on Foscam C2 devices with System Firmware 1.11.1.8 and Application Firmware 2.72.1.32, and Opticam i5 devices with System Firmware 1.5.2.11 and Application Firmware 2.21.1.128. /mnt/mtd/boot.sh has 0777 permissions, allowing local users to control the commands executed at system start-up.

CVE-2018-19077 [HIGH] CWE-125 CVE-2018-19077: An issue was discovered on Foscam Opticam i5 devices with System Firmware 1.5.2.11 and Application F An issue was discovered on Foscam Opticam i5 devices with System Firmware 1.5.2.11 and Application Firmware 2.21.1.128. RtspServer allows remote attackers to cause a denial of service (daemon hang or restart) via a negative integer in the RTSP Content-Length header.

CVE-2018-19075 [MEDIUM] CWE-200 CVE-2018-19075: An issue was discovered on Foscam C2 devices with System Firmware 1.11.1.8 and Application Firmware An issue was discovered on Foscam C2 devices with System Firmware 1.11.1.8 and Application Firmware 2.72.1.32, and Opticam i5 devices with System Firmware 1.5.2.11 and Application Firmware 2.21.1.128. The firewall feature makes it easier for remote attackers to ascertain credentials and firewall rules because invalid credentials lead to error -2, whe

CVE-2018-19080 [MEDIUM] CWE-79 CVE-2018-19080: An issue was discovered on Foscam Opticam i5 devices with System Firmware 1.5.2.11 and Application F An issue was discovered on Foscam Opticam i5 devices with System Firmware 1.5.2.11 and Application Firmware 2.21.1.128. The ONVIF devicemgmt SetHostname method allows unauthenticated persistent XSS.

CVE-2018-19068 [MEDIUM] CVE-2018-19068: An issue was discovered on Foscam Opticam i5 devices with System Firmware 1.5.2.11 and Application F An issue was discovered on Foscam Opticam i5 devices with System Firmware 1.5.2.11 and Application Firmware 2.21.1.128. The CGIProxy.fcgi?cmd=setTelnetSwitch feature is authorized for hidden factory credentials.

CVE-2018-19072 [MEDIUM] CWE-732 CVE-2018-19072: An issue was discovered on Foscam C2 devices with System Firmware 1.11.1.8 and Application Firmware An issue was discovered on Foscam C2 devices with System Firmware 1.11.1.8 and Application Firmware 2.72.1.32, and Opticam i5 devices with System Firmware 1.5.2.11 and Application Firmware 2.21.1.128. /mnt/mtd/app has 0777 permissions, allowing local users to replace an archive file (within that directory) to control what is extracted to RAM at boot