VAR-201405-0317
Vulnerability from variot - Updated: 2023-12-18 12:45Foscam IP camera 11.37.2.49 and other versions, when using the Foscam DynDNS option, generates credentials based on predictable camera subdomain names, which allows remote attackers to spoof or hijack arbitrary cameras and conduct other attacks by modifying arbitrary camera records in the Foscam DNS server. FOSCAM IP-Cameras is a webcam device. An information disclosure vulnerability exists in Foscam IP Camera version 11.37.2.49. When using the Foscam DynDNS option, the program uses the camera subdomain as the username and password. An attacker can exploit this issue to gain access to sensitive information and perform certain unauthorized actions; this may lead to further attacks
Show details on source website{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"configurations": {
"@id": "https://www.variotdbs.pl/ref/configurations"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-201405-0317",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "ip camera",
"scope": "eq",
"trust": 1.6,
"vendor": "foscam",
"version": "11.37.2.49"
},
{
"model": "ip camera",
"scope": "eq",
"trust": 0.8,
"vendor": "foscam intelligent",
"version": "11.37.2.49"
},
{
"model": "foscam intelligent technology limited copyright. foscam ip camera",
"scope": "eq",
"trust": 0.6,
"vendor": "",
"version": "11.37.2.49"
},
{
"model": "ip camera",
"scope": "eq",
"trust": 0.3,
"vendor": "foscam digital",
"version": "11.37.2.49"
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2014-03022"
},
{
"db": "BID",
"id": "67510"
},
{
"db": "JVNDB",
"id": "JVNDB-2014-002495"
},
{
"db": "NVD",
"id": "CVE-2014-1849"
},
{
"db": "CNNVD",
"id": "CNNVD-201405-228"
}
]
},
"configurations": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/configurations#",
"children": {
"@container": "@list"
},
"cpe_match": {
"@container": "@list"
},
"data": {
"@container": "@list"
},
"nodes": {
"@container": "@list"
}
},
"data": [
{
"CVE_data_version": "4.0",
"nodes": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:o:foscam:ip_camera_firmware:11.37.2.49:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
}
]
}
],
"sources": [
{
"db": "NVD",
"id": "CVE-2014-1849"
}
]
},
"credits": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/credits#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Sergey Shekyan",
"sources": [
{
"db": "BID",
"id": "67510"
}
],
"trust": 0.3
},
"cve": "CVE-2014-1849",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [
{
"acInsufInfo": false,
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "NVD",
"availabilityImpact": "COMPLETE",
"baseScore": 10.0,
"confidentialityImpact": "COMPLETE",
"exploitabilityScore": 10.0,
"impactScore": 10.0,
"integrityImpact": "COMPLETE",
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"severity": "HIGH",
"trust": 1.0,
"userInteractionRequired": false,
"vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C",
"version": "2.0"
},
{
"acInsufInfo": null,
"accessComplexity": "Low",
"accessVector": "Network",
"authentication": "None",
"author": "NVD",
"availabilityImpact": "Complete",
"baseScore": 10.0,
"confidentialityImpact": "Complete",
"exploitabilityScore": null,
"id": "CVE-2014-1849",
"impactScore": null,
"integrityImpact": "Complete",
"obtainAllPrivilege": null,
"obtainOtherPrivilege": null,
"obtainUserPrivilege": null,
"severity": "High",
"trust": 0.8,
"userInteractionRequired": null,
"vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C",
"version": "2.0"
},
{
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "CNVD",
"availabilityImpact": "COMPLETE",
"baseScore": 10.0,
"confidentialityImpact": "COMPLETE",
"exploitabilityScore": 10.0,
"id": "CNVD-2014-03022",
"impactScore": 10.0,
"integrityImpact": "COMPLETE",
"severity": "HIGH",
"trust": 0.6,
"vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C",
"version": "2.0"
},
{
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "VULHUB",
"availabilityImpact": "COMPLETE",
"baseScore": 10.0,
"confidentialityImpact": "COMPLETE",
"exploitabilityScore": 10.0,
"id": "VHN-69788",
"impactScore": 10.0,
"integrityImpact": "COMPLETE",
"severity": "HIGH",
"trust": 0.1,
"vectorString": "AV:N/AC:L/AU:N/C:C/I:C/A:C",
"version": "2.0"
}
],
"cvssV3": [],
"severity": [
{
"author": "NVD",
"id": "CVE-2014-1849",
"trust": 1.8,
"value": "HIGH"
},
{
"author": "CNVD",
"id": "CNVD-2014-03022",
"trust": 0.6,
"value": "HIGH"
},
{
"author": "CNNVD",
"id": "CNNVD-201405-228",
"trust": 0.6,
"value": "CRITICAL"
},
{
"author": "VULHUB",
"id": "VHN-69788",
"trust": 0.1,
"value": "HIGH"
}
]
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2014-03022"
},
{
"db": "VULHUB",
"id": "VHN-69788"
},
{
"db": "JVNDB",
"id": "JVNDB-2014-002495"
},
{
"db": "NVD",
"id": "CVE-2014-1849"
},
{
"db": "CNNVD",
"id": "CNNVD-201405-228"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Foscam IP camera 11.37.2.49 and other versions, when using the Foscam DynDNS option, generates credentials based on predictable camera subdomain names, which allows remote attackers to spoof or hijack arbitrary cameras and conduct other attacks by modifying arbitrary camera records in the Foscam DNS server. FOSCAM IP-Cameras is a webcam device. An information disclosure vulnerability exists in Foscam IP Camera version 11.37.2.49. When using the Foscam DynDNS option, the program uses the camera subdomain as the username and password. \nAn attacker can exploit this issue to gain access to sensitive information and perform certain unauthorized actions; this may lead to further attacks",
"sources": [
{
"db": "NVD",
"id": "CVE-2014-1849"
},
{
"db": "JVNDB",
"id": "JVNDB-2014-002495"
},
{
"db": "CNVD",
"id": "CNVD-2014-03022"
},
{
"db": "BID",
"id": "67510"
},
{
"db": "VULHUB",
"id": "VHN-69788"
}
],
"trust": 2.52
},
"exploit_availability": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/exploit_availability#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"reference": "https://www.scap.org.cn/vuln/vhn-69788",
"trust": 0.1,
"type": "unknown"
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-69788"
}
]
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "NVD",
"id": "CVE-2014-1849",
"trust": 3.4
},
{
"db": "JVNDB",
"id": "JVNDB-2014-002495",
"trust": 0.8
},
{
"db": "CNNVD",
"id": "CNNVD-201405-228",
"trust": 0.7
},
{
"db": "CNVD",
"id": "CNVD-2014-03022",
"trust": 0.6
},
{
"db": "FULLDISC",
"id": "20140508 CVE-2014-1849 FOSCAM DYNAMIC DNS PREDICTABLE CREDENTIALS VULNERABILITY",
"trust": 0.6
},
{
"db": "BID",
"id": "67510",
"trust": 0.4
},
{
"db": "EXPLOIT-DB",
"id": "39195",
"trust": 0.1
},
{
"db": "PACKETSTORM",
"id": "126559",
"trust": 0.1
},
{
"db": "VULHUB",
"id": "VHN-69788",
"trust": 0.1
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2014-03022"
},
{
"db": "VULHUB",
"id": "VHN-69788"
},
{
"db": "BID",
"id": "67510"
},
{
"db": "JVNDB",
"id": "JVNDB-2014-002495"
},
{
"db": "NVD",
"id": "CVE-2014-1849"
},
{
"db": "CNNVD",
"id": "CNNVD-201405-228"
}
]
},
"id": "VAR-201405-0317",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "CNVD",
"id": "CNVD-2014-03022"
},
{
"db": "VULHUB",
"id": "VHN-69788"
}
],
"trust": 0.06999999999999999
},
"iot_taxonomy": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot_taxonomy#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"category": [
"Network device"
],
"sub_category": null,
"trust": 0.6
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2014-03022"
}
]
},
"last_update_date": "2023-12-18T12:45:21.394000Z",
"patch": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/patch#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"title": "Top Page",
"trust": 0.8,
"url": "http://foscam.us/"
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2014-002495"
}
]
},
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "CWE-255",
"trust": 1.9
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-69788"
},
{
"db": "JVNDB",
"id": "JVNDB-2014-002495"
},
{
"db": "NVD",
"id": "CVE-2014-1849"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 2.8,
"url": "http://blog.shekyan.com/2014/05/cve-2014-1849-foscam-dynamic-dns-predictable-credentials-vulnerability.html"
},
{
"trust": 2.5,
"url": "https://github.com/artemharutyunyan/getmecamtool/blob/master/src/dnsmod.c"
},
{
"trust": 2.3,
"url": "http://seclists.org/fulldisclosure/2014/may/35"
},
{
"trust": 0.8,
"url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2014-1849"
},
{
"trust": 0.8,
"url": "http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2014-1849"
},
{
"trust": 0.3,
"url": "http://www.foscam.com/"
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2014-03022"
},
{
"db": "VULHUB",
"id": "VHN-69788"
},
{
"db": "BID",
"id": "67510"
},
{
"db": "JVNDB",
"id": "JVNDB-2014-002495"
},
{
"db": "NVD",
"id": "CVE-2014-1849"
},
{
"db": "CNNVD",
"id": "CNNVD-201405-228"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "CNVD",
"id": "CNVD-2014-03022"
},
{
"db": "VULHUB",
"id": "VHN-69788"
},
{
"db": "BID",
"id": "67510"
},
{
"db": "JVNDB",
"id": "JVNDB-2014-002495"
},
{
"db": "NVD",
"id": "CVE-2014-1849"
},
{
"db": "CNNVD",
"id": "CNNVD-201405-228"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2014-05-16T00:00:00",
"db": "CNVD",
"id": "CNVD-2014-03022"
},
{
"date": "2014-05-14T00:00:00",
"db": "VULHUB",
"id": "VHN-69788"
},
{
"date": "2014-05-08T00:00:00",
"db": "BID",
"id": "67510"
},
{
"date": "2014-05-16T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2014-002495"
},
{
"date": "2014-05-14T00:55:08.133000",
"db": "NVD",
"id": "CVE-2014-1849"
},
{
"date": "2014-05-15T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201405-228"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2014-05-16T00:00:00",
"db": "CNVD",
"id": "CNVD-2014-03022"
},
{
"date": "2014-05-14T00:00:00",
"db": "VULHUB",
"id": "VHN-69788"
},
{
"date": "2014-05-08T00:00:00",
"db": "BID",
"id": "67510"
},
{
"date": "2014-05-16T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2014-002495"
},
{
"date": "2014-05-14T18:43:10.867000",
"db": "NVD",
"id": "CVE-2014-1849"
},
{
"date": "2014-06-04T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201405-228"
}
]
},
"threat_type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/threat_type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "remote",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201405-228"
}
],
"trust": 0.6
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Foscam IP camera Vulnerable to camouflaging or hijacking any camera",
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2014-002495"
}
],
"trust": 0.8
},
"type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "trust management",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201405-228"
}
],
"trust": 0.6
}
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
Loading…