Vulnerability Description
An issue was discovered on certain ABUS TVIP cameras. The CGI scripts allow remote attackers to execute code via system() as root. There are several injection points in various scripts.
CVSS Score
CRITICAL
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Abus | Tvip 10000 Firmware | - |
| Abus | Tvip 10000 | - |
| Abus | Tvip 10001 Firmware | - |
| Abus | Tvip 10001 | - |
| Abus | Tvip 10005 Firmware | - |
| Abus | Tvip 10005 | - |
| Abus | Tvip 10005A Firmware | - |
| Abus | Tvip 10005A | - |
| Abus | Tvip 10005B Firmware | - |
| Abus | Tvip 10005B | - |
| Abus | Tvip 10050 Firmware | - |
| Abus | Tvip 10050 | - |
| Abus | Tvip 10051 Firmware | - |
| Abus | Tvip 10051 | - |
| Abus | Tvip 10055A Firmware | - |
| Abus | Tvip 10055A | - |
| Abus | Tvip 10055B Firmware | - |
| Abus | Tvip 10055B | - |
| Abus | Tvip 10500 Firmware | - |
| Abus | Tvip 10500 | - |
Related Weaknesses (CWE)
References
- https://sec.maride.cc/posts/abus/#cve-2018-17879ExploitThird Party Advisory
- https://www.ccc.de/en/updates/2019/update-nicht-verfugbar-hersteller-nicht-zu-erThird Party Advisory
- https://sec.maride.cc/posts/abus/#cve-2018-17879ExploitThird Party Advisory
- https://www.ccc.de/en/updates/2019/update-nicht-verfugbar-hersteller-nicht-zu-erThird Party Advisory
FAQ
What is CVE-2018-17879?
CVE-2018-17879 is a vulnerability with a CVSS score of 9.8 (CRITICAL). An issue was discovered on certain ABUS TVIP cameras. The CGI scripts allow remote attackers to execute code via system() as root. There are several injection points in various scripts.
How severe is CVE-2018-17879?
CVE-2018-17879 has been rated CRITICAL with a CVSS base score of 9.8/10. This is considered a critical vulnerability requiring immediate attention.
Is there a patch for CVE-2018-17879?
Check the references section above for vendor advisories and patch information. Affected products include: Abus Tvip 10000 Firmware, Abus Tvip 10000, Abus Tvip 10001 Firmware, Abus Tvip 10001, Abus Tvip 10005 Firmware.