The flaw is in the Zivif PR115-204-P-RS webcam (firmware V2.3.4.2103), where the web CGI interface lacks authentication checks on requests to its CGI pages. An unauthenticated remote attacker can retrieve the device's credentials by sending a standard HTTP request to /cgi-bin/hi3510/param.cgi?cmd=getuser, requiring no prior access or user interaction.
Credentials for Zivif PR115-204-P-RS V2.3.4.2103 Webcams can be obtained by an unauthenticated remote attacker using a standard web /cgi-bin/hi3510/param.cgi?cmd=getuser HTTP request. This vulnerability exists because of a lack of authentication checks in requests to CGI pages.
First seen exploited 5 years after disclosure.
No ATT&CK techniques are linked to this CVE yet. MITRE CTID has not mapped it, and no report passage in the corpus ties it to a technique.
Reports are matched by finding the exact id CVE-2017-17106 in their text; nobody has reviewed the match. One passage is shown per report, at most 320 characters, linked to the original.
CVE-2017-17106: Credentials for Zivif PR115-204-P-RS V2.3.4.2103 Webcams can be obtained by an unauthenticated remote attacker using a standard web /cgi-bin/hi3510/param.cgi?cmd=getuser HTTP request.
2 passages name itOriginal (opens in a new tab) ↗
Microsoft researchers have also identified that previous reports have used the vulnerability ID “ZERO-32906” for CVE-2018-20057, “GPON” for CVE-2018-10561, and “DLINK” for CVE-2016-20017; and that CVE-2020-7209 was mislabeled as CVE-2017-17106 and CVE-2022-42013 was mislabeled as CVE-2021-42013.
Pulses are indicator collections that anyone can publish. A mention is not confirmation of exploitation.