The flaw is an unauthenticated, blind remote command injection in the CGI scripts that make up the web interface of Zivif PR115-204-P-RS web cameras. An attacker who can reach the camera's web interface over the network can inject operating system commands through a crafted request to a CGI endpoint such as cgi-bin/iptest.cgi, with no credentials or user interaction required.
Zivif PR115-204-P-RS V2.3.4.2103 and V4.7.4.2121 (and possibly in-between versions) web cameras are vulnerable to unauthenticated, blind remote command injection via CGI scripts used as part of the web interface, as demonstrated by a cgi-bin/iptest.cgi?cmd=iptest.cgi&-time="1504225666237"&-url=$(reboot) request.
First seen exploited 5 years after disclosure. Public exploit code (Metasploit) was available 4 months before disclosure.
No high- or medium-confidence techniques. The 1 available link are lower confidence and listed below.
These come from early or generic mappings, text matching, or contradict this CVE’s details (for example a public-facing technique on a bug that needs a user to open a file). Shown for completeness.
Reports are matched by finding the exact id CVE-2017-17105 in their text; nobody has reviewed the match. One passage is shown per report, at most 320 characters, linked to the original.
…softwareCVE-2017-17105Zivif PR115-204-P-RSCVE-2019-10655GrandstreamCVE-2020-25223WebAdmin of Sophos SG UTMCVE-2021-42013ApacheCVE-2022-31137Roxy-WICVE-2022-33891Apache SparkZSL-2022-5717MiniDVBLinuxSince the release of Zerobot 1.1, the malware operators have removed CVE-2018-12613, a phpMyAdmin…
Pulses are indicator collections that anyone can publish. A mention is not confirmation of exploitation.