critical9.8Public exploit code
CVE-2017-8225
On Wireless IP Camera (P2P) WIFICAM devices, access to .ini files (containing credentials) is not correctly checked.
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- Wireless IP Camera (P2P) WIFICAM - Remote Code Execution2017-03-08 · remote · hardware
Impact
On Wireless IP Camera (P2P) WIFICAM devices, access to .ini files (containing credentials) is not correctly checked. An attacker can bypass authentication by providing an empty loginuse parameter and an empty loginpas parameter in the URI.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Wificam | Wireless Ip Camera \(P2p\) Firmware | All versions |
Weakness classification
References
- NVD record
- CVE.org record
- http://seclists.org/fulldisclosure/2017/Mar/23
- https://pierrekim.github.io/blog/2017-03-08-camera-goahead-0day.html#pre-auth-info-leak-goahead
- http://seclists.org/fulldisclosure/2017/Mar/23
- https://pierrekim.github.io/blog/2017-03-08-camera-goahead-0day.html#pre-auth-info-leak-goahead