Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
8.8
CVE-2017-5675: Foscam/Vstarcam cameras let attackers run commands via mail form
CVE-2017-5675 · published 9 years ago
Summary
The built‑in GoAhead web server on certain Foscam, Vstarcam and other white‑label IP cameras processes a mail‑sending page that accepts user input without checking it. An attacker can place malicious text in the "receiver1" field, causing the camera to execute commands with full system rights. Apply any available firmware updates or disable the mail feature until a patch is released.
What to do
The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| embedthis | goahead |
All versions
cpe:2.3:a:embedthis:goahead:-:*:*:*:*:*:*:* |
Original advisory text
A command-injection vulnerability exists in a web application on a custom-built GoAhead web server used on Foscam, Vstarcam, and multiple white-label IP camera models. The mail-sending form in the ...
A command-injection vulnerability exists in a web application on a custom-built GoAhead web server used on Foscam, Vstarcam, and multiple white-label IP camera models. The mail-sending form in the mail.htm page allows an attacker to inject a command into the receiver1 field in the form; it will be executed with root privileges.
References
- https://www.cybereason.com/cve-ip-cameras/ Exploit Third Party Advisory
- https://www.cybereason.com/zero-day-exploits-turn-hundreds-of-thousands-of-ip-ca... Exploit Technical Description Third Party Advisory
Internet-facing
14 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit (estimated)
- Gives an attacker full control (estimated)
Type
CWE-77Command Injection
Timeline
Published13 Mar 2017
Updated3 Nov 2026
First seen29 Sep 2026
Sources
CVE-2017-5675 · NVD
Track software like this
Free during beta