Zavio IP Cameras CVE-2013-2568 Arbitrary Command Injection Vulnerability

Bugtraq ID:	60190
Class:	Design Error
CVE:	CVE-2013-2568
Remote:	Yes
Local:	No
Published:	May 28 2013 12:00AM
Updated:	May 28 2013 12:00AM
Credit:	Nahuel Riva and Francisco Falcon from Core Exploit Writers Team.
Vulnerable:	Zavio IP Cameras 1.6.3
Not Vulnerable:

Zavio IP Cameras CVE-2013-2568 Arbitrary Command Injection Vulnerability

Zavio IP Cameras are prone to a remote arbitrary command-injection vulnerability.

Successful exploits will allow attackers to execute arbitrary commands in the context of the affected application. This may further aid in other attacks.

Zavio IP Cameras running firmware version 1.6.03 and below are vulnerable.

Zavio IP Cameras CVE-2013-2568 Arbitrary Command Injection Vulnerability

An attacker can exploit this issue using a web browser.

The following proof-of-concept is available:

• /data/vulnerabilities/exploits/60190.txt

Zavio IP Cameras CVE-2013-2568 Arbitrary Command Injection Vulnerability

Solution:
Currently, we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

Zavio IP Cameras CVE-2013-2568 Arbitrary Command Injection Vulnerability

References:

• Zavio IP Cameras HomePage (Zavio)
  
• Zavio IP Cameras multiple vulnerabilities (CORE )