VAR-201706-1009
Vulnerability from variot - Updated: 2025-04-20 20:16'/cgi-bin/admin/testserver.cgi' of the web service in most of the VIVOTEK Network Cameras is vulnerable to shell command injection, which allows remote attackers to execute any shell command as root via a crafted HTTP request. This vulnerability is already verified on VIVOTEK Network Camera IB8369/FD8164/FD816BA; most others have similar firmware that may be affected. An attack uses shell metacharacters in the senderemail parameter. VIVOTEKNetworkCameras IB8369, FD8164 and FD816BA are all network camera products of China VIVOTEK. A security vulnerability exists in the /cgi-bin/admin/testserver.cgi file for Web services in VIVOTEKNetworkCamerasIB8369, FD8164, and FD816BA
Show details on source website{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"configurations": {
"@id": "https://www.variotdbs.pl/ref/configurations"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-201706-1009",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "network camera fd816ba",
"scope": "eq",
"trust": 1.6,
"vendor": "vivotek",
"version": "fd816ba-vvtk-010101."
},
{
"model": "network camera fd8164",
"scope": "eq",
"trust": 1.6,
"vendor": "vivotek",
"version": "fd8164-_vvtk-0200b"
},
{
"model": "network camera ib8369",
"scope": "eq",
"trust": 1.6,
"vendor": "vivotek",
"version": "ib8369-vvtk-0102a"
},
{
"model": "network camera fd8164",
"scope": null,
"trust": 0.8,
"vendor": "vivotek",
"version": null
},
{
"model": "network camera fd816ba",
"scope": null,
"trust": 0.8,
"vendor": "vivotek",
"version": null
},
{
"model": "network camera ib8369",
"scope": null,
"trust": 0.8,
"vendor": "vivotek",
"version": null
},
{
"model": "ib8369",
"scope": null,
"trust": 0.6,
"vendor": "vivotek",
"version": null
},
{
"model": "fd8164",
"scope": null,
"trust": 0.6,
"vendor": "vivotek",
"version": null
},
{
"model": "fd816ba",
"scope": null,
"trust": 0.6,
"vendor": "vivotek",
"version": null
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2017-12593"
},
{
"db": "JVNDB",
"id": "JVNDB-2017-005190"
},
{
"db": "CNNVD",
"id": "CNNVD-201706-1061"
},
{
"db": "NVD",
"id": "CVE-2017-9828"
}
]
},
"configurations": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/configurations#",
"children": {
"@container": "@list"
},
"cpe_match": {
"@container": "@list"
},
"data": {
"@container": "@list"
},
"nodes": {
"@container": "@list"
}
},
"data": [
{
"CVE_data_version": "4.0",
"nodes": [
{
"cpe_match": [
{
"cpe22Uri": "cpe:/o:vivotek:network_camera_fd8164_firmware",
"vulnerable": true
},
{
"cpe22Uri": "cpe:/o:vivotek:network_camera_fd816ba_firmware",
"vulnerable": true
},
{
"cpe22Uri": "cpe:/o:vivotek:network_camera_ib8369_firmware",
"vulnerable": true
}
],
"operator": "OR"
}
]
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2017-005190"
}
]
},
"cve": "CVE-2017-9828",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [
{
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "nvd@nist.gov",
"availabilityImpact": "COMPLETE",
"baseScore": 10.0,
"confidentialityImpact": "COMPLETE",
"exploitabilityScore": 10.0,
"id": "CVE-2017-9828",
"impactScore": 10.0,
"integrityImpact": "COMPLETE",
"severity": "HIGH",
"trust": 1.9,
"vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C",
"version": "2.0"
},
{
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "CNVD",
"availabilityImpact": "COMPLETE",
"baseScore": 10.0,
"confidentialityImpact": "COMPLETE",
"exploitabilityScore": 10.0,
"id": "CNVD-2017-12593",
"impactScore": 10.0,
"integrityImpact": "COMPLETE",
"severity": "HIGH",
"trust": 0.6,
"vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C",
"version": "2.0"
},
{
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "VULHUB",
"availabilityImpact": "COMPLETE",
"baseScore": 10.0,
"confidentialityImpact": "COMPLETE",
"exploitabilityScore": 10.0,
"id": "VHN-118031",
"impactScore": 10.0,
"integrityImpact": "COMPLETE",
"severity": "HIGH",
"trust": 0.1,
"vectorString": "AV:N/AC:L/AU:N/C:C/I:C/A:C",
"version": "2.0"
}
],
"cvssV3": [
{
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"author": "nvd@nist.gov",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"exploitabilityScore": 3.9,
"id": "CVE-2017-9828",
"impactScore": 5.9,
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"trust": 1.8,
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.0"
}
],
"severity": [
{
"author": "nvd@nist.gov",
"id": "CVE-2017-9828",
"trust": 1.0,
"value": "CRITICAL"
},
{
"author": "NVD",
"id": "CVE-2017-9828",
"trust": 0.8,
"value": "Critical"
},
{
"author": "CNVD",
"id": "CNVD-2017-12593",
"trust": 0.6,
"value": "HIGH"
},
{
"author": "CNNVD",
"id": "CNNVD-201706-1061",
"trust": 0.6,
"value": "CRITICAL"
},
{
"author": "VULHUB",
"id": "VHN-118031",
"trust": 0.1,
"value": "HIGH"
},
{
"author": "VULMON",
"id": "CVE-2017-9828",
"trust": 0.1,
"value": "HIGH"
}
]
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2017-12593"
},
{
"db": "VULHUB",
"id": "VHN-118031"
},
{
"db": "VULMON",
"id": "CVE-2017-9828"
},
{
"db": "JVNDB",
"id": "JVNDB-2017-005190"
},
{
"db": "CNNVD",
"id": "CNNVD-201706-1061"
},
{
"db": "NVD",
"id": "CVE-2017-9828"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "\u0027/cgi-bin/admin/testserver.cgi\u0027 of the web service in most of the VIVOTEK Network Cameras is vulnerable to shell command injection, which allows remote attackers to execute any shell command as root via a crafted HTTP request. This vulnerability is already verified on VIVOTEK Network Camera IB8369/FD8164/FD816BA; most others have similar firmware that may be affected. An attack uses shell metacharacters in the senderemail parameter. VIVOTEKNetworkCameras IB8369, FD8164 and FD816BA are all network camera products of China VIVOTEK. A security vulnerability exists in the /cgi-bin/admin/testserver.cgi file for Web services in VIVOTEKNetworkCamerasIB8369, FD8164, and FD816BA",
"sources": [
{
"db": "NVD",
"id": "CVE-2017-9828"
},
{
"db": "JVNDB",
"id": "JVNDB-2017-005190"
},
{
"db": "CNVD",
"id": "CNVD-2017-12593"
},
{
"db": "VULHUB",
"id": "VHN-118031"
},
{
"db": "VULMON",
"id": "CVE-2017-9828"
}
],
"trust": 2.34
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "NVD",
"id": "CVE-2017-9828",
"trust": 3.3
},
{
"db": "JVNDB",
"id": "JVNDB-2017-005190",
"trust": 0.8
},
{
"db": "CNNVD",
"id": "CNNVD-201706-1061",
"trust": 0.7
},
{
"db": "CNVD",
"id": "CNVD-2017-12593",
"trust": 0.6
},
{
"db": "OTHER",
"id": "NONE",
"trust": 0.1
},
{
"db": "VULHUB",
"id": "VHN-118031",
"trust": 0.1
},
{
"db": "VULMON",
"id": "CVE-2017-9828",
"trust": 0.1
}
],
"sources": [
{
"db": "OTHER",
"id": null
},
{
"db": "CNVD",
"id": "CNVD-2017-12593"
},
{
"db": "VULHUB",
"id": "VHN-118031"
},
{
"db": "VULMON",
"id": "CVE-2017-9828"
},
{
"db": "JVNDB",
"id": "JVNDB-2017-005190"
},
{
"db": "CNNVD",
"id": "CNNVD-201706-1061"
},
{
"db": "NVD",
"id": "CVE-2017-9828"
}
]
},
"id": "VAR-201706-1009",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "OTHER",
"id": null
},
{
"db": "CNVD",
"id": "CNVD-2017-12593"
},
{
"db": "VULHUB",
"id": "VHN-118031"
}
],
"trust": 1.70625
},
"iot_taxonomy": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot_taxonomy#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"category": [
"Network device"
],
"sub_category": null,
"trust": 0.6
},
{
"category": [
"camera device"
],
"sub_category": "camera",
"trust": 0.1
}
],
"sources": [
{
"db": "OTHER",
"id": null
},
{
"db": "CNVD",
"id": "CNVD-2017-12593"
}
]
},
"last_update_date": "2025-04-20T20:16:44.603000Z",
"patch": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/patch#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"title": "VIVOTEK Network Cameras",
"trust": 0.8,
"url": "http://www.vivotek.com/network-cameras/#type-filter:path=default|resolution-filter:path=default|snv-filter:path=default|wdr-filter:path=default|lens-filter:path=default|ir-filter:path=default|environment-filter:path=default|views:view=jplist-grid-view"
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2017-005190"
}
]
},
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "CWE-78",
"trust": 1.1
},
{
"problemtype": "CWE-77",
"trust": 0.9
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-118031"
},
{
"db": "JVNDB",
"id": "JVNDB-2017-005190"
},
{
"db": "NVD",
"id": "CVE-2017-9828"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 3.2,
"url": "https://blog.cal1.cn/post/an%20easy%20way%20to%20pwn%20most%20of%20the%20vivotek%20network%20cameras"
},
{
"trust": 0.8,
"url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2017-9828"
},
{
"trust": 0.8,
"url": "https://nvd.nist.gov/vuln/detail/cve-2017-9828"
},
{
"trust": 0.1,
"url": "https://ieeexplore.ieee.org/abstract/document/10769424"
},
{
"trust": 0.1,
"url": "https://cwe.mitre.org/data/definitions/78.html"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov"
}
],
"sources": [
{
"db": "OTHER",
"id": null
},
{
"db": "CNVD",
"id": "CNVD-2017-12593"
},
{
"db": "VULHUB",
"id": "VHN-118031"
},
{
"db": "VULMON",
"id": "CVE-2017-9828"
},
{
"db": "JVNDB",
"id": "JVNDB-2017-005190"
},
{
"db": "CNNVD",
"id": "CNNVD-201706-1061"
},
{
"db": "NVD",
"id": "CVE-2017-9828"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "OTHER",
"id": null
},
{
"db": "CNVD",
"id": "CNVD-2017-12593"
},
{
"db": "VULHUB",
"id": "VHN-118031"
},
{
"db": "VULMON",
"id": "CVE-2017-9828"
},
{
"db": "JVNDB",
"id": "JVNDB-2017-005190"
},
{
"db": "CNNVD",
"id": "CNNVD-201706-1061"
},
{
"db": "NVD",
"id": "CVE-2017-9828"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2017-07-04T00:00:00",
"db": "CNVD",
"id": "CNVD-2017-12593"
},
{
"date": "2017-06-23T00:00:00",
"db": "VULHUB",
"id": "VHN-118031"
},
{
"date": "2017-06-23T00:00:00",
"db": "VULMON",
"id": "CVE-2017-9828"
},
{
"date": "2017-07-20T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2017-005190"
},
{
"date": "2017-06-28T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201706-1061"
},
{
"date": "2017-06-23T22:29:00.163000",
"db": "NVD",
"id": "CVE-2017-9828"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2017-07-04T00:00:00",
"db": "CNVD",
"id": "CNVD-2017-12593"
},
{
"date": "2019-10-03T00:00:00",
"db": "VULHUB",
"id": "VHN-118031"
},
{
"date": "2019-10-03T00:00:00",
"db": "VULMON",
"id": "CVE-2017-9828"
},
{
"date": "2017-07-20T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2017-005190"
},
{
"date": "2019-10-23T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201706-1061"
},
{
"date": "2025-04-20T01:37:25.860000",
"db": "NVD",
"id": "CVE-2017-9828"
}
]
},
"threat_type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/threat_type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "remote",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201706-1061"
}
],
"trust": 0.6
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "plural VIVOTEK Network Camera Product Web Service of /cgi-bin/admin/testserver.cgi Vulnerable to shell command insertion",
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2017-005190"
}
],
"trust": 0.8
},
"type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "operating system commend injection",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201706-1061"
}
],
"trust": 0.6
}
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
Loading…