Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
8.8

Foscam C1 Indoor HD Camera allows remote command execution

CVE-2017-2828 · published 9 years ago
Summary

The web interface of the Foscam C1 Indoor HD Camera (firmware 2.52.2.37) can be tricked into running any command when a specially crafted request is sent during account creation. This lets an attacker take control of the camera and potentially the network it is on. Update the firmware to a fixed version or disable remote account creation until a patch is applied.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
foscam c1_indoor_hd_camera_firmware 2.52.2.37
cpe:2.3:o:foscam:c1_indoor_hd_camera_firmware:2.52.2.37:*:*:*:*:*:*:*
Original advisory text
An exploitable command injection vulnerability exists in the web management interface used by the Foscam C1 Indoor HD Camera running application firmware 2.52.2.37. A specially crafted HTTP request...
An exploitable command injection vulnerability exists in the web management interface used by the Foscam C1 Indoor HD Camera running application firmware 2.52.2.37. A specially crafted HTTP request can allow for a user to inject arbitrary shell characters during account creation resulting in command injection. An attacker can simply send an HTTP request to the device to trigger this vulnerability.
References
Fix within
Internet-facing 14 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit (estimated)
  • Gives an attacker full control (estimated)
Severity
8.8 High
Exploitation
8% chance of attack within 30 days
Type
CWE-78OS Command Injection
Timeline
Published21 Jun 2017
Updated15 Oct 2026
First seen29 Sep 2026
Sources
CVE-2017-2828 · NVD
Track software like this
Free during beta