critical9.1
CVE-2018-3937
An exploitable command injection vulnerability exists in the measurementBitrateExec functionality of Sony IPELA E Series Network Camera G5 firmware 1.87.00.
Impact
An exploitable command injection vulnerability exists in the measurementBitrateExec functionality of Sony IPELA E Series Network Camera G5 firmware 1.87.00. A specially crafted GET request can cause arbitrary commands to be executed. An attacker can send an HTTP request to trigger this vulnerability.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Sony | Snc-Eb600 Firmware | Version 1.87.00 |
| Sony | Snc-Eb630 Firmware | Version 1.87.00 |
| Sony | Snc-Eb600b Firmware | Version 1.87.00 |
| Sony | Snc-Eb630b Firmware | Version 1.87.00 |
| Sony | Snc-Eb602r Firmware | Version 1.87.00 |
| Sony | Snc-Eb632r Firmware | Version 1.87.00 |
| Sony | Snc-Em600 Firmware | Version 1.87.00 |
| Sony | Snc-Em601 Firmware | Version 1.87.00 |
| Sony | Snc-Em630 Firmware | Version 1.87.00 |
| Sony | Snc-Em631 Firmware | Version 1.87.00 |
| Sony | Snc-Em602r Firmware | Version 1.87.00 |
| Sony | Snc-Em632r Firmware | Version 1.87.00 |