CVE-2017-18377
9.8
CRITICAL · CVSS 3.1 · EPSS 6.8% (pctl 94)
In your normal cycle
Critical by CVSS (9.8), but no sign of active exploitation.
Description
An issue was discovered on Wireless IP Camera (P2P) WIFICAM cameras. There is Command Injection in the set_ftp.cgi script via shell metacharacters in the pwd variable, as demonstrated by a set_ftp.cgi?svr=192.168.1.1&port=21&user=ftp URI.
Scoring
| CVSS | 9.8 (CRITICAL, v3.1) |
|---|---|
| Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| EPSS | 6.8% — more likely to be exploited than 94% of all CVEs |
| Weakness | CWE-77 |
| On CISA KEV | no |
| Public exploit | none known |
| Published | 2019-06-11 |
| Last modified | 2026-06-17 |
Affected (2)
| Vendor | Product |
|---|---|
| goahead | wireless ip camera wificam |
| goahead | wireless ip camera wificam firmware |
References
→ the Explorer · watch your stack · NVD