CVE-2020-7879CWE-78

ipTIME C200 IP Camera command injection vulnerability

High · published November 30, 2021

CVSS v3.1
8.8
EPSS
1%
Percentile
73.1
In the wild
Unconfirmed
What it is

This issue was discovered when the ipTIME C200 IP Camera was synchronized with the ipTIME NAS. It is necessary to extract value for ipTIME IP camera because the ipTIME NAS send ans setCookie('[COOKIE]') . The value is transferred to the --header option in wget binary, and there is no validation check. This vulnerability allows remote attackers to execute remote command.

The record
Technical detail
CVSS v3.1
8.8 · HIGH
Vector
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.01448 · 73.1th percentile
Weakness
CWE-78 · Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Published
2021-11-30T18:37Z
EPSS history
Timeline
  • 30 NOV 18:37Z
    ipTIME C200 IP Camera command injection vulnerability
    cvelistv5