var-201405-0317
Vulnerability from variot
Foscam IP camera 11.37.2.49 and other versions, when using the Foscam DynDNS option, generates credentials based on predictable camera subdomain names, which allows remote attackers to spoof or hijack arbitrary cameras and conduct other attacks by modifying arbitrary camera records in the Foscam DNS server. FOSCAM IP-Cameras is a webcam device. An information disclosure vulnerability exists in Foscam IP Camera version 11.37.2.49. When using the Foscam DynDNS option, the program uses the camera subdomain as the username and password. An attacker can exploit this issue to gain access to sensitive information and perform certain unauthorized actions; this may lead to further attacks
Show details on source website{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"configurations": {
"@id": "https://www.variotdbs.pl/ref/configurations"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-201405-0317",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "ip camera",
"scope": "eq",
"trust": 1.6,
"vendor": "foscam",
"version": "11.37.2.49"
},
{
"model": "ip camera",
"scope": "eq",
"trust": 0.8,
"vendor": "foscam intelligent",
"version": "11.37.2.49"
},
{
"model": "foscam intelligent technology limited copyright. foscam ip camera",
"scope": "eq",
"trust": 0.6,
"vendor": "",
"version": "11.37.2.49"
},
{
"model": "ip camera",
"scope": "eq",
"trust": 0.3,
"vendor": "foscam digital",
"version": "11.37.2.49"
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2014-03022"
},
{
"db": "BID",
"id": "67510"
},
{
"db": "JVNDB",
"id": "JVNDB-2014-002495"
},
{
"db": "NVD",
"id": "CVE-2014-1849"
},
{
"db": "CNNVD",
"id": "CNNVD-201405-228"
}
]
},
"configurations": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/configurations#",
"children": {
"@container": "@list"
},
"cpe_match": {
"@container": "@list"
},
"data": {
"@container": "@list"
},
"nodes": {
"@container": "@list"
}
},
"data": [
{
"CVE_data_version": "4.0",
"nodes": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:o:foscam:ip_camera_firmware:11.37.2.49:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
}
]
}
],
"sources": [
{
"db": "NVD",
"id": "CVE-2014-1849"
}
]
},
"credits": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/credits#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Sergey Shekyan",
"sources": [
{
"db": "BID",
"id": "67510"
}
],
"trust": 0.3
},
"cve": "CVE-2014-1849",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [
{
"acInsufInfo": false,
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "NVD",
"availabilityImpact": "COMPLETE",
"baseScore": 10.0,
"confidentialityImpact": "COMPLETE",
"exploitabilityScore": 10.0,
"impactScore": 10.0,
"integrityImpact": "COMPLETE",
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"severity": "HIGH",
"trust": 1.0,
"userInteractionRequired": false,
"vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C",
"version": "2.0"
},
{
"acInsufInfo": null,
"accessComplexity": "Low",
"accessVector": "Network",
"authentication": "None",
"author": "NVD",
"availabilityImpact": "Complete",
"baseScore": 10.0,
"confidentialityImpact": "Complete",
"exploitabilityScore": null,
"id": "CVE-2014-1849",
"impactScore": null,
"integrityImpact": "Complete",
"obtainAllPrivilege": null,
"obtainOtherPrivilege": null,
"obtainUserPrivilege": null,
"severity": "High",
"trust": 0.8,
"userInteractionRequired": null,
"vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C",
"version": "2.0"
},
{
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "CNVD",
"availabilityImpact": "COMPLETE",
"baseScore": 10.0,
"confidentialityImpact": "COMPLETE",
"exploitabilityScore": 10.0,
"id": "CNVD-2014-03022",
"impactScore": 10.0,
"integrityImpact": "COMPLETE",
"severity": "HIGH",
"trust": 0.6,
"vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C",
"version": "2.0"
},
{
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "VULHUB",
"availabilityImpact": "COMPLETE",
"baseScore": 10.0,
"confidentialityImpact": "COMPLETE",
"exploitabilityScore": 10.0,
"id": "VHN-69788",
"impactScore": 10.0,
"integrityImpact": "COMPLETE",
"severity": "HIGH",
"trust": 0.1,
"vectorString": "AV:N/AC:L/AU:N/C:C/I:C/A:C",
"version": "2.0"
}
],
"cvssV3": [],
"severity": [
{
"author": "NVD",
"id": "CVE-2014-1849",
"trust": 1.8,
"value": "HIGH"
},
{
"author": "CNVD",
"id": "CNVD-2014-03022",
"trust": 0.6,
"value": "HIGH"
},
{
"author": "CNNVD",
"id": "CNNVD-201405-228",
"trust": 0.6,
"value": "CRITICAL"
},
{
"author": "VULHUB",
"id": "VHN-69788",
"trust": 0.1,
"value": "HIGH"
}
]
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2014-03022"
},
{
"db": "VULHUB",
"id": "VHN-69788"
},
{
"db": "JVNDB",
"id": "JVNDB-2014-002495"
},
{
"db": "NVD",
"id": "CVE-2014-1849"
},
{
"db": "CNNVD",
"id": "CNNVD-201405-228"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Foscam IP camera 11.37.2.49 and other versions, when using the Foscam DynDNS option, generates credentials based on predictable camera subdomain names, which allows remote attackers to spoof or hijack arbitrary cameras and conduct other attacks by modifying arbitrary camera records in the Foscam DNS server. FOSCAM IP-Cameras is a webcam device. An information disclosure vulnerability exists in Foscam IP Camera version 11.37.2.49. When using the Foscam DynDNS option, the program uses the camera subdomain as the username and password. \nAn attacker can exploit this issue to gain access to sensitive information and perform certain unauthorized actions; this may lead to further attacks",
"sources": [
{
"db": "NVD",
"id": "CVE-2014-1849"
},
{
"db": "JVNDB",
"id": "JVNDB-2014-002495"
},
{
"db": "CNVD",
"id": "CNVD-2014-03022"
},
{
"db": "BID",
"id": "67510"
},
{
"db": "VULHUB",
"id": "VHN-69788"
}
],
"trust": 2.52
},
"exploit_availability": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/exploit_availability#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"reference": "https://www.scap.org.cn/vuln/vhn-69788",
"trust": 0.1,
"type": "unknown"
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-69788"
}
]
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "NVD",
"id": "CVE-2014-1849",
"trust": 3.4
},
{
"db": "JVNDB",
"id": "JVNDB-2014-002495",
"trust": 0.8
},
{
"db": "CNNVD",
"id": "CNNVD-201405-228",
"trust": 0.7
},
{
"db": "CNVD",
"id": "CNVD-2014-03022",
"trust": 0.6
},
{
"db": "FULLDISC",
"id": "20140508 CVE-2014-1849 FOSCAM DYNAMIC DNS PREDICTABLE CREDENTIALS VULNERABILITY",
"trust": 0.6
},
{
"db": "BID",
"id": "67510",
"trust": 0.4
},
{
"db": "EXPLOIT-DB",
"id": "39195",
"trust": 0.1
},
{
"db": "PACKETSTORM",
"id": "126559",
"trust": 0.1
},
{
"db": "VULHUB",
"id": "VHN-69788",
"trust": 0.1
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2014-03022"
},
{
"db": "VULHUB",
"id": "VHN-69788"
},
{
"db": "BID",
"id": "67510"
},
{
"db": "JVNDB",
"id": "JVNDB-2014-002495"
},
{
"db": "NVD",
"id": "CVE-2014-1849"
},
{
"db": "CNNVD",
"id": "CNNVD-201405-228"
}
]
},
"id": "VAR-201405-0317",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "CNVD",
"id": "CNVD-2014-03022"
},
{
"db": "VULHUB",
"id": "VHN-69788"
}
],
"trust": 0.06999999999999999
},
"iot_taxonomy": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot_taxonomy#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"category": [
"Network device"
],
"sub_category": null,
"trust": 0.6
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2014-03022"
}
]
},
"last_update_date": "2023-12-18T12:45:21.394000Z",
"patch": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/patch#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"title": "Top Page",
"trust": 0.8,
"url": "http://foscam.us/"
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2014-002495"
}
]
},
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "CWE-255",
"trust": 1.9
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-69788"
},
{
"db": "JVNDB",
"id": "JVNDB-2014-002495"
},
{
"db": "NVD",
"id": "CVE-2014-1849"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 2.8,
"url": "http://blog.shekyan.com/2014/05/cve-2014-1849-foscam-dynamic-dns-predictable-credentials-vulnerability.html"
},
{
"trust": 2.5,
"url": "https://github.com/artemharutyunyan/getmecamtool/blob/master/src/dnsmod.c"
},
{
"trust": 2.3,
"url": "http://seclists.org/fulldisclosure/2014/may/35"
},
{
"trust": 0.8,
"url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2014-1849"
},
{
"trust": 0.8,
"url": "http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2014-1849"
},
{
"trust": 0.3,
"url": "http://www.foscam.com/"
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2014-03022"
},
{
"db": "VULHUB",
"id": "VHN-69788"
},
{
"db": "BID",
"id": "67510"
},
{
"db": "JVNDB",
"id": "JVNDB-2014-002495"
},
{
"db": "NVD",
"id": "CVE-2014-1849"
},
{
"db": "CNNVD",
"id": "CNNVD-201405-228"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "CNVD",
"id": "CNVD-2014-03022"
},
{
"db": "VULHUB",
"id": "VHN-69788"
},
{
"db": "BID",
"id": "67510"
},
{
"db": "JVNDB",
"id": "JVNDB-2014-002495"
},
{
"db": "NVD",
"id": "CVE-2014-1849"
},
{
"db": "CNNVD",
"id": "CNNVD-201405-228"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2014-05-16T00:00:00",
"db": "CNVD",
"id": "CNVD-2014-03022"
},
{
"date": "2014-05-14T00:00:00",
"db": "VULHUB",
"id": "VHN-69788"
},
{
"date": "2014-05-08T00:00:00",
"db": "BID",
"id": "67510"
},
{
"date": "2014-05-16T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2014-002495"
},
{
"date": "2014-05-14T00:55:08.133000",
"db": "NVD",
"id": "CVE-2014-1849"
},
{
"date": "2014-05-15T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201405-228"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2014-05-16T00:00:00",
"db": "CNVD",
"id": "CNVD-2014-03022"
},
{
"date": "2014-05-14T00:00:00",
"db": "VULHUB",
"id": "VHN-69788"
},
{
"date": "2014-05-08T00:00:00",
"db": "BID",
"id": "67510"
},
{
"date": "2014-05-16T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2014-002495"
},
{
"date": "2014-05-14T18:43:10.867000",
"db": "NVD",
"id": "CVE-2014-1849"
},
{
"date": "2014-06-04T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201405-228"
}
]
},
"threat_type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/threat_type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "remote",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201405-228"
}
],
"trust": 0.6
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Foscam IP camera Vulnerable to camouflaging or hijacking any camera",
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2014-002495"
}
],
"trust": 0.8
},
"type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "trust management",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201405-228"
}
],
"trust": 0.6
}
}
Loading...
Loading...
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.