Zavio IP Cameras CVE-2013-2570 Command Injection Vulnerability

Bugtraq ID:	60188
Class:	Input Validation Error
CVE:	CVE-2013-2570
Remote:	Yes
Local:	No
Published:	May 28 2013 12:00AM
Updated:	Dec 02 2013 12:28AM
Credit:	Nahuel Riva and Francisco Falcon from Core Exploit Writers Team
Vulnerable:
Not Vulnerable:

Zavio IP Cameras CVE-2013-2570 Command Injection Vulnerability

Zavio IP Cameras are prone to a command-injection vulnerability.

Exploiting this issue could allow an attacker to execute arbitrary commands in the context of the affected device.

Zavio IP Cameras running firmware version 1.6.03 and below are vulnerable.

Zavio IP Cameras CVE-2013-2570 Command Injection Vulnerability

Core Security Technologies has developed a working commercial exploit for its CORE IMPACT product.

The following proof-of-concept is available:

• /data/vulnerabilities/exploits/60188.html.txt

Zavio IP Cameras CVE-2013-2570 Command Injection Vulnerability

Solution:
Currently, we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

Zavio IP Cameras CVE-2013-2570 Command Injection Vulnerability

References: