CVE-2017-5674 A vulnerability in a custom-built GoAhead web server used on Foscam, Vstarcam, and multiple white-label IP camera models allows an attacker to craft a malformed HTTP ("GET system.ini HTTP/1.1\n\n" - n...
CriticalCVSS 9.8
EPSS 21.6%
- Published
- Updated
- Exploit status
- No public exploit known
Description
A vulnerability in a custom-built GoAhead web server used on Foscam, Vstarcam, and multiple white-label IP camera models allows an attacker to craft a malformed HTTP ("GET system.ini HTTP/1.1\n\n" - note the lack of "/" in the path field of the request) request that will disclose the configuration file with the login password.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| embedthis goahead | All versions | No fix listed |
References
- www.cybereason.com exploit technical-description third-party-advisory
- www.cybereason.com exploit third-party-advisory