cvelistv5 - CVE-2017-5174

CVE-2017-5174 (GCVE-0-2017-5174)

Vulnerability from cvelistv5

Published

2017-05-19 02:43

Modified

2024-08-05 14:55

Severity ?

CWE

CWE-288

Summary

References

URL

	Vendor	Product	Version
	n/a	Geutebruck IP Cameras	Version: Geutebruck IP Cameras

var-201705-3256

Vulnerability from variot

An Authentication Bypass issue was discovered in Geutebruck IP Camera G-Cam/EFD-2250 Version 1.11.0.12. An authentication bypass vulnerability has been identified. The existing file system architecture could allow attackers to bypass the access control that may allow remote code execution. Geutebruck IP Camera G-Cam/EFD-2250 Contains an access control vulnerability.Information is obtained, information is altered, and service operation is disrupted (DoS) There is a possibility of being put into a state. The Geutebruck G-Cam/EFD-2250 provides a faster and safer solution for remote monitoring applications. An attacker exploited the vulnerability to gain unauthorized access to the affected device environment. Failed exploit attempts may result in a denial-of-service condition. G-Cam/EFD-2250 1.11.0.12 is vulnerable; other versions may also be affected. Geutebruck IP Camera G-Cam/EFD-2250 is germany Geutebruck A network camera of the company

Show details on source website

JSON

To clipboard

{
  "affected_products": {
    "_id": null,
    "data": [
      {
        "_id": null,
        "model": "ip camera g-cam efd-2250",
        "scope": "eq",
        "trust": 1.6,
        "vendor": "geutebruck",
        "version": "1.11.0.12"
      },
      {
        "_id": null,
        "model": "g-cam/efd-2250",
        "scope": "eq",
        "trust": 1.1,
        "vendor": "geutebruck",
        "version": "1.11.0.12"
      },
      {
        "_id": null,
        "model": "g-cam/efd-2250",
        "scope": "eq",
        "trust": 0.6,
        "vendor": "geutebrueck",
        "version": "1.11.0.12"
      },
      {
        "_id": null,
        "model": null,
        "scope": "eq",
        "trust": 0.2,
        "vendor": "ip camera g cam efd 2250",
        "version": "1.11.0.12"
      }
    ],
    "sources": [
      {
        "db": "IVD",
        "id": "409c1fe8-a44c-4075-b30d-bc6e6046c75f"
      },
      {
        "db": "CNVD",
        "id": "CNVD-2017-01888"
      },
      {
        "db": "BID",
        "id": "96209"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2017-004264"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201702-610"
      },
      {
        "db": "NVD",
        "id": "CVE-2017-5174"
      }
    ]
  },
  "configurations": {
    "_id": null,
    "data": [
      {
        "CVE_data_version": "4.0",
        "nodes": [
          {
            "cpe_match": [
              {
                "cpe22Uri": "cpe:/o:geutebruck:g-cam%2fefd-2250_firmware",
                "vulnerable": true
              }
            ],
            "operator": "OR"
          }
        ]
      }
    ],
    "sources": [
      {
        "db": "JVNDB",
        "id": "JVNDB-2017-004264"
      }
    ]
  },
  "credits": {
    "_id": null,
    "data": "Florent Montel, Frederic Cikala, and Davy Douhine of RandoriSec",
    "sources": [
      {
        "db": "BID",
        "id": "96209"
      }
    ],
    "trust": 0.3
  },
  "cve": "CVE-2017-5174",
  "cvss": {
    "_id": null,
    "data": [
      {
        "cvssV2": [
          {
            "accessComplexity": "LOW",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "author": "nvd@nist.gov",
            "availabilityImpact": "PARTIAL",
            "baseScore": 7.5,
            "confidentialityImpact": "PARTIAL",
            "exploitabilityScore": 10.0,
            "id": "CVE-2017-5174",
            "impactScore": 6.4,
            "integrityImpact": "PARTIAL",
            "severity": "HIGH",
            "trust": 1.9,
            "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
            "version": "2.0"
          },
          {
            "accessComplexity": "LOW",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "author": "CNVD",
            "availabilityImpact": "COMPLETE",
            "baseScore": 10.0,
            "confidentialityImpact": "COMPLETE",
            "exploitabilityScore": 10.0,
            "id": "CNVD-2017-01888",
            "impactScore": 10.0,
            "integrityImpact": "COMPLETE",
            "severity": "HIGH",
            "trust": 0.6,
            "vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C",
            "version": "2.0"
          },
          {
            "accessComplexity": "LOW",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "author": "IVD",
            "availabilityImpact": "COMPLETE",
            "baseScore": 10.0,
            "confidentialityImpact": "COMPLETE",
            "exploitabilityScore": 10.0,
            "id": "409c1fe8-a44c-4075-b30d-bc6e6046c75f",
            "impactScore": 10.0,
            "integrityImpact": "COMPLETE",
            "severity": "HIGH",
            "trust": 0.2,
            "vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C",
            "version": "2.9 [IVD]"
          },
          {
            "accessComplexity": "LOW",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "author": "VULHUB",
            "availabilityImpact": "PARTIAL",
            "baseScore": 7.5,
            "confidentialityImpact": "PARTIAL",
            "exploitabilityScore": 10.0,
            "id": "VHN-113377",
            "impactScore": 6.4,
            "integrityImpact": "PARTIAL",
            "severity": "HIGH",
            "trust": 0.1,
            "vectorString": "AV:N/AC:L/AU:N/C:P/I:P/A:P",
            "version": "2.0"
          }
        ],
        "cvssV3": [
          {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "author": "nvd@nist.gov",
            "availabilityImpact": "HIGH",
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "exploitabilityScore": 3.9,
            "id": "CVE-2017-5174",
            "impactScore": 5.9,
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "trust": 1.8,
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.0"
          }
        ],
        "severity": [
          {
            "author": "nvd@nist.gov",
            "id": "CVE-2017-5174",
            "trust": 1.0,
            "value": "CRITICAL"
          },
          {
            "author": "NVD",
            "id": "CVE-2017-5174",
            "trust": 0.8,
            "value": "Critical"
          },
          {
            "author": "CNVD",
            "id": "CNVD-2017-01888",
            "trust": 0.6,
            "value": "HIGH"
          },
          {
            "author": "CNNVD",
            "id": "CNNVD-201702-610",
            "trust": 0.6,
            "value": "CRITICAL"
          },
          {
            "author": "IVD",
            "id": "409c1fe8-a44c-4075-b30d-bc6e6046c75f",
            "trust": 0.2,
            "value": "CRITICAL"
          },
          {
            "author": "VULHUB",
            "id": "VHN-113377",
            "trust": 0.1,
            "value": "HIGH"
          },
          {
            "author": "VULMON",
            "id": "CVE-2017-5174",
            "trust": 0.1,
            "value": "HIGH"
          }
        ]
      }
    ],
    "sources": [
      {
        "db": "IVD",
        "id": "409c1fe8-a44c-4075-b30d-bc6e6046c75f"
      },
      {
        "db": "CNVD",
        "id": "CNVD-2017-01888"
      },
      {
        "db": "VULHUB",
        "id": "VHN-113377"
      },
      {
        "db": "VULMON",
        "id": "CVE-2017-5174"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2017-004264"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201702-610"
      },
      {
        "db": "NVD",
        "id": "CVE-2017-5174"
      }
    ]
  },
  "description": {
    "_id": null,
    "data": "An Authentication Bypass issue was discovered in Geutebruck IP Camera G-Cam/EFD-2250 Version 1.11.0.12. An authentication bypass vulnerability has been identified. The existing file system architecture could allow attackers to bypass the access control that may allow remote code execution. Geutebruck IP Camera G-Cam/EFD-2250 Contains an access control vulnerability.Information is obtained, information is altered, and service operation is disrupted (DoS) There is a possibility of being put into a state. The Geutebruck G-Cam/EFD-2250 provides a faster and safer solution for remote monitoring applications. An attacker exploited the vulnerability to gain unauthorized access to the affected device environment. Failed exploit attempts may result in a denial-of-service condition. \nG-Cam/EFD-2250 1.11.0.12 is vulnerable; other versions may also be affected. Geutebruck IP Camera G-Cam/EFD-2250 is germany Geutebruck A network camera of the company",
    "sources": [
      {
        "db": "NVD",
        "id": "CVE-2017-5174"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2017-004264"
      },
      {
        "db": "CNVD",
        "id": "CNVD-2017-01888"
      },
      {
        "db": "BID",
        "id": "96209"
      },
      {
        "db": "IVD",
        "id": "409c1fe8-a44c-4075-b30d-bc6e6046c75f"
      },
      {
        "db": "VULHUB",
        "id": "VHN-113377"
      },
      {
        "db": "VULMON",
        "id": "CVE-2017-5174"
      }
    ],
    "trust": 2.79
  },
  "exploit_availability": {
    "_id": null,
    "data": [
      {
        "reference": "https://www.scap.org.cn/vuln/vhn-113377",
        "trust": 0.1,
        "type": "unknown"
      },
      {
        "reference": "https://vulmon.com/exploitdetails?qidtp=exploitdb\u0026qid=41360",
        "trust": 0.1,
        "type": "exploit"
      }
    ],
    "sources": [
      {
        "db": "VULHUB",
        "id": "VHN-113377"
      },
      {
        "db": "VULMON",
        "id": "CVE-2017-5174"
      }
    ]
  },
  "external_ids": {
    "_id": null,
    "data": [
      {
        "db": "NVD",
        "id": "CVE-2017-5174",
        "trust": 3.7
      },
      {
        "db": "ICS CERT",
        "id": "ICSA-17-045-02",
        "trust": 2.9
      },
      {
        "db": "BID",
        "id": "96209",
        "trust": 2.7
      },
      {
        "db": "EXPLOIT-DB",
        "id": "41360",
        "trust": 1.8
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201702-610",
        "trust": 0.9
      },
      {
        "db": "CNVD",
        "id": "CNVD-2017-01888",
        "trust": 0.8
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2017-004264",
        "trust": 0.8
      },
      {
        "db": "IVD",
        "id": "409C1FE8-A44C-4075-B30D-BC6E6046C75F",
        "trust": 0.2
      },
      {
        "db": "VULHUB",
        "id": "VHN-113377",
        "trust": 0.1
      },
      {
        "db": "VULMON",
        "id": "CVE-2017-5174",
        "trust": 0.1
      }
    ],
    "sources": [
      {
        "db": "IVD",
        "id": "409c1fe8-a44c-4075-b30d-bc6e6046c75f"
      },
      {
        "db": "CNVD",
        "id": "CNVD-2017-01888"
      },
      {
        "db": "VULHUB",
        "id": "VHN-113377"
      },
      {
        "db": "VULMON",
        "id": "CVE-2017-5174"
      },
      {
        "db": "BID",
        "id": "96209"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2017-004264"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201702-610"
      },
      {
        "db": "NVD",
        "id": "CVE-2017-5174"
      }
    ]
  },
  "id": "VAR-201705-3256",
  "iot": {
    "_id": null,
    "data": true,
    "sources": [
      {
        "db": "IVD",
        "id": "409c1fe8-a44c-4075-b30d-bc6e6046c75f"
      },
      {
        "db": "CNVD",
        "id": "CNVD-2017-01888"
      },
      {
        "db": "VULHUB",
        "id": "VHN-113377"
      }
    ],
    "trust": 1.7041666750000002
  },
  "iot_taxonomy": {
    "_id": null,
    "data": [
      {
        "category": [
          "IoT",
          "ICS"
        ],
        "sub_category": null,
        "trust": 0.6
      },
      {
        "category": [
          "ICS"
        ],
        "sub_category": null,
        "trust": 0.2
      }
    ],
    "sources": [
      {
        "db": "IVD",
        "id": "409c1fe8-a44c-4075-b30d-bc6e6046c75f"
      },
      {
        "db": "CNVD",
        "id": "CNVD-2017-01888"
      }
    ]
  },
  "last_update_date": "2024-11-23T22:13:01.847000Z",
  "patch": {
    "_id": null,
    "data": [
      {
        "title": "Top Page",
        "trust": 0.8,
        "url": "https://www.geutebrueck.com/en_EN.html"
      },
      {
        "title": "Geutebruck G-Cam/EFD-2250 authentication bypass vulnerability patch",
        "trust": 0.6,
        "url": "https://www.cnvd.org.cn/patchInfo/show/89708"
      },
      {
        "title": "Geutebr\u00fcck G-Cam/EFD-2250 Security vulnerabilities",
        "trust": 0.6,
        "url": "http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=68205"
      }
    ],
    "sources": [
      {
        "db": "CNVD",
        "id": "CNVD-2017-01888"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2017-004264"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201702-610"
      }
    ]
  },
  "problemtype_data": {
    "_id": null,
    "data": [
      {
        "problemtype": "CWE-288",
        "trust": 1.0
      },
      {
        "problemtype": "NVD-CWE-noinfo",
        "trust": 1.0
      },
      {
        "problemtype": "CWE-284",
        "trust": 0.9
      }
    ],
    "sources": [
      {
        "db": "VULHUB",
        "id": "VHN-113377"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2017-004264"
      },
      {
        "db": "NVD",
        "id": "CVE-2017-5174"
      }
    ]
  },
  "references": {
    "_id": null,
    "data": [
      {
        "trust": 2.7,
        "url": "https://ics-cert.us-cert.gov/advisories/icsa-17-045-02"
      },
      {
        "trust": 2.4,
        "url": "http://www.securityfocus.com/bid/96209"
      },
      {
        "trust": 1.9,
        "url": "https://www.exploit-db.com/exploits/41360/"
      },
      {
        "trust": 0.8,
        "url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2017-5174"
      },
      {
        "trust": 0.8,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2017-5174"
      },
      {
        "trust": 0.3,
        "url": "http://www.geutebrueck.com/en_en/product-overview-31934.html"
      },
      {
        "trust": 0.3,
        "url": "https://ics-cert.us-cert.gov/advisories/icsa-17-045-02 "
      },
      {
        "trust": 0.1,
        "url": "https://cwe.mitre.org/data/definitions/.html"
      },
      {
        "trust": 0.1,
        "url": "https://tools.cisco.com/security/center/viewalert.x?alertid=52663"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov"
      }
    ],
    "sources": [
      {
        "db": "CNVD",
        "id": "CNVD-2017-01888"
      },
      {
        "db": "VULHUB",
        "id": "VHN-113377"
      },
      {
        "db": "VULMON",
        "id": "CVE-2017-5174"
      },
      {
        "db": "BID",
        "id": "96209"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2017-004264"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201702-610"
      },
      {
        "db": "NVD",
        "id": "CVE-2017-5174"
      }
    ]
  },
  "sources": {
    "_id": null,
    "data": [
      {
        "db": "IVD",
        "id": "409c1fe8-a44c-4075-b30d-bc6e6046c75f",
        "ident": null
      },
      {
        "db": "CNVD",
        "id": "CNVD-2017-01888",
        "ident": null
      },
      {
        "db": "VULHUB",
        "id": "VHN-113377",
        "ident": null
      },
      {
        "db": "VULMON",
        "id": "CVE-2017-5174",
        "ident": null
      },
      {
        "db": "BID",
        "id": "96209",
        "ident": null
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2017-004264",
        "ident": null
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201702-610",
        "ident": null
      },
      {
        "db": "NVD",
        "id": "CVE-2017-5174",
        "ident": null
      }
    ]
  },
  "sources_release_date": {
    "_id": null,
    "data": [
      {
        "date": "2017-02-24T00:00:00",
        "db": "IVD",
        "id": "409c1fe8-a44c-4075-b30d-bc6e6046c75f",
        "ident": null
      },
      {
        "date": "2017-02-24T00:00:00",
        "db": "CNVD",
        "id": "CNVD-2017-01888",
        "ident": null
      },
      {
        "date": "2017-05-19T00:00:00",
        "db": "VULHUB",
        "id": "VHN-113377",
        "ident": null
      },
      {
        "date": "2017-05-19T00:00:00",
        "db": "VULMON",
        "id": "CVE-2017-5174",
        "ident": null
      },
      {
        "date": "2017-02-14T00:00:00",
        "db": "BID",
        "id": "96209",
        "ident": null
      },
      {
        "date": "2017-06-21T00:00:00",
        "db": "JVNDB",
        "id": "JVNDB-2017-004264",
        "ident": null
      },
      {
        "date": "2017-02-20T00:00:00",
        "db": "CNNVD",
        "id": "CNNVD-201702-610",
        "ident": null
      },
      {
        "date": "2017-05-19T03:29:00.230000",
        "db": "NVD",
        "id": "CVE-2017-5174",
        "ident": null
      }
    ]
  },
  "sources_update_date": {
    "_id": null,
    "data": [
      {
        "date": "2017-02-24T00:00:00",
        "db": "CNVD",
        "id": "CNVD-2017-01888",
        "ident": null
      },
      {
        "date": "2019-10-03T00:00:00",
        "db": "VULHUB",
        "id": "VHN-113377",
        "ident": null
      },
      {
        "date": "2019-10-03T00:00:00",
        "db": "VULMON",
        "id": "CVE-2017-5174",
        "ident": null
      },
      {
        "date": "2017-03-07T04:02:00",
        "db": "BID",
        "id": "96209",
        "ident": null
      },
      {
        "date": "2017-06-21T00:00:00",
        "db": "JVNDB",
        "id": "JVNDB-2017-004264",
        "ident": null
      },
      {
        "date": "2019-10-23T00:00:00",
        "db": "CNNVD",
        "id": "CNNVD-201702-610",
        "ident": null
      },
      {
        "date": "2024-11-21T03:27:12.083000",
        "db": "NVD",
        "id": "CVE-2017-5174",
        "ident": null
      }
    ]
  },
  "threat_type": {
    "_id": null,
    "data": "remote",
    "sources": [
      {
        "db": "CNNVD",
        "id": "CNNVD-201702-610"
      }
    ],
    "trust": 0.6
  },
  "title": {
    "_id": null,
    "data": "Geutebruck IP Camera G-Cam/EFD-2250 Access control vulnerability",
    "sources": [
      {
        "db": "JVNDB",
        "id": "JVNDB-2017-004264"
      }
    ],
    "trust": 0.8
  },
  "type": {
    "_id": null,
    "data": "lack of information",
    "sources": [
      {
        "db": "CNNVD",
        "id": "CNNVD-201702-610"
      }
    ],
    "trust": 0.6
  }
}

fkie_cve-2017-5174

Vulnerability from fkie_nvd

Published

2017-05-19 03:29

Modified

2025-04-20 01:37

Severity ?

9.8 (Critical) - CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Summary

References

URL	Tags
ics-cert@hq.dhs.gov	http://www.securityfocus.com/bid/96209	Third Party Advisory, VDB Entry
ics-cert@hq.dhs.gov	https://ics-cert.us-cert.gov/advisories/ICSA-17-045-02	Third Party Advisory, US Government Resource
ics-cert@hq.dhs.gov	https://www.exploit-db.com/exploits/41360/
af854a3a-2127-422b-91ae-364da2661108	http://www.securityfocus.com/bid/96209	Third Party Advisory, VDB Entry
af854a3a-2127-422b-91ae-364da2661108	https://ics-cert.us-cert.gov/advisories/ICSA-17-045-02	Third Party Advisory, US Government Resource
af854a3a-2127-422b-91ae-364da2661108	https://www.exploit-db.com/exploits/41360/

Impacted products

	Vendor	Product	Version
	geutebruck	ip_camera_g-cam_efd-2250_firmware	1.11.0.12
	geutebruck	ip_camera_g-cam_efd-2250	-

JSON

To clipboard

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:geutebruck:ip_camera_g-cam_efd-2250_firmware:1.11.0.12:*:*:*:*:*:*:*",
              "matchCriteriaId": "0CC60E66-0E77-4184-91F6-998F734263C4",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:geutebruck:ip_camera_g-cam_efd-2250:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "D3B888B6-5D16-428D-BABB-5384EEDB9542",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "An Authentication Bypass issue was discovered in Geutebruck IP Camera G-Cam/EFD-2250 Version 1.11.0.12. An authentication bypass vulnerability has been identified. The existing file system architecture could allow attackers to bypass the access control that may allow remote code execution."
    },
    {
      "lang": "es",
      "value": "Se detect\u00f3 un problema de Omisi\u00f3n de Autenticaci\u00f3n en la c\u00e1mara IP G-Cam/EFD-2250 versi\u00f3n 1.11.0.12 de Geutebruck. Se ha identificado una vulnerabilidad de omisi\u00f3n de autenticaci\u00f3n. La arquitectura del sistema de archivos existente podr\u00eda permitir a los atacantes omitir el control de acceso que puede permitir la ejecuci\u00f3n de c\u00f3digo remota."
    }
  ],
  "id": "CVE-2017-5174",
  "lastModified": "2025-04-20T01:37:25.860",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": true,
        "baseSeverity": "HIGH",
        "cvssData": {
          "accessComplexity": "LOW",
          "accessVector": "NETWORK",
          "authentication": "NONE",
          "availabilityImpact": "PARTIAL",
          "baseScore": 7.5,
          "confidentialityImpact": "PARTIAL",
          "integrityImpact": "PARTIAL",
          "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
          "version": "2.0"
        },
        "exploitabilityScore": 10.0,
        "impactScore": 6.4,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": false,
        "obtainUserPrivilege": false,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV30": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 9.8,
          "baseSeverity": "CRITICAL",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "version": "3.0"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 5.9,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ]
  },
  "published": "2017-05-19T03:29:00.230",
  "references": [
    {
      "source": "ics-cert@hq.dhs.gov",
      "tags": [
        "Third Party Advisory",
        "VDB Entry"
      ],
      "url": "http://www.securityfocus.com/bid/96209"
    },
    {
      "source": "ics-cert@hq.dhs.gov",
      "tags": [
        "Third Party Advisory",
        "US Government Resource"
      ],
      "url": "https://ics-cert.us-cert.gov/advisories/ICSA-17-045-02"
    },
    {
      "source": "ics-cert@hq.dhs.gov",
      "url": "https://www.exploit-db.com/exploits/41360/"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Third Party Advisory",
        "VDB Entry"
      ],
      "url": "http://www.securityfocus.com/bid/96209"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Third Party Advisory",
        "US Government Resource"
      ],
      "url": "https://ics-cert.us-cert.gov/advisories/ICSA-17-045-02"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://www.exploit-db.com/exploits/41360/"
    }
  ],
  "sourceIdentifier": "ics-cert@hq.dhs.gov",
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-288"
        }
      ],
      "source": "ics-cert@hq.dhs.gov",
      "type": "Secondary"
    },
    {
      "description": [
        {
          "lang": "en",
          "value": "NVD-CWE-noinfo"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}

cnvd-2017-01888

Vulnerability from cnvd

Title

Geutebruck G-Cam/EFD-2250身份认证绕过漏洞

Description

Geutebruck G-Cam/EFD-2250提供了远程监控应用程序更快更安全的解决方案。 Geutebruck G-Cam/EFD-2250存在身份认证绕过漏洞。攻击者利用该漏洞在受影响设备环境中未经授权访问。

Severity

高

Patch Name

Geutebruck G-Cam/EFD-2250身份认证绕过漏洞的补丁

Patch Description

Geutebruck G-Cam/EFD-2250提供了远程监控应用程序更快更安全的解决方案。 Geutebruck G-Cam/EFD-2250存在身份认证绕过漏洞。攻击者利用该漏洞在受影响设备环境中未经授权访问。目前，供应商发布了安全公告及相关补丁信息，修复了此漏洞。

Formal description

用户可参考如下供应商提供的安全公告获得补丁信息： http://www.geutebrueck.com/en_EN/product-overview-31934.html

Reference

http://www.securityfocus.com/bid/96209

Impacted products

Name
Geutebrueck G-Cam/EFD-2250 1.11.0.12

Show details on source website

JSON

To clipboard

{
  "bids": {
    "bid": {
      "bidNumber": "96209"
    }
  },
  "cves": {
    "cve": {
      "cveNumber": "CVE-2017-5174"
    }
  },
  "description": "Geutebruck G-Cam/EFD-2250\u63d0\u4f9b\u4e86\u8fdc\u7a0b\u76d1\u63a7\u5e94\u7528\u7a0b\u5e8f\u66f4\u5feb\u66f4\u5b89\u5168\u7684\u89e3\u51b3\u65b9\u6848\u3002\r\n\r\nGeutebruck G-Cam/EFD-2250\u5b58\u5728\u8eab\u4efd\u8ba4\u8bc1\u7ed5\u8fc7\u6f0f\u6d1e\u3002\u653b\u51fb\u8005\u5229\u7528\u8be5\u6f0f\u6d1e\u5728\u53d7\u5f71\u54cd\u8bbe\u5907\u73af\u5883\u4e2d\u672a\u7ecf\u6388\u6743\u8bbf\u95ee\u3002",
  "discovererName": "Florent Montel, Frederic Cikala, and Davy Douhine of RandoriSec",
  "formalWay": "\u7528\u6237\u53ef\u53c2\u8003\u5982\u4e0b\u4f9b\u5e94\u5546\u63d0\u4f9b\u7684\u5b89\u5168\u516c\u544a\u83b7\u5f97\u8865\u4e01\u4fe1\u606f\uff1a\r\nhttp://www.geutebrueck.com/en_EN/product-overview-31934.html",
  "isEvent": "\u901a\u7528\u8f6f\u786c\u4ef6\u6f0f\u6d1e",
  "number": "CNVD-2017-01888",
  "openTime": "2017-02-24",
  "patchDescription": "Geutebruck G-Cam/EFD-2250\u63d0\u4f9b\u4e86\u8fdc\u7a0b\u76d1\u63a7\u5e94\u7528\u7a0b\u5e8f\u66f4\u5feb\u66f4\u5b89\u5168\u7684\u89e3\u51b3\u65b9\u6848\u3002\r\n\r\nGeutebruck G-Cam/EFD-2250\u5b58\u5728\u8eab\u4efd\u8ba4\u8bc1\u7ed5\u8fc7\u6f0f\u6d1e\u3002\u653b\u51fb\u8005\u5229\u7528\u8be5\u6f0f\u6d1e\u5728\u53d7\u5f71\u54cd\u8bbe\u5907\u73af\u5883\u4e2d\u672a\u7ecf\u6388\u6743\u8bbf\u95ee\u3002\u76ee\u524d\uff0c\u4f9b\u5e94\u5546\u53d1\u5e03\u4e86\u5b89\u5168\u516c\u544a\u53ca\u76f8\u5173\u8865\u4e01\u4fe1\u606f\uff0c\u4fee\u590d\u4e86\u6b64\u6f0f\u6d1e\u3002",
  "patchName": "Geutebruck G-Cam/EFD-2250\u8eab\u4efd\u8ba4\u8bc1\u7ed5\u8fc7\u6f0f\u6d1e\u7684\u8865\u4e01",
  "products": {
    "product": "Geutebrueck G-Cam/EFD-2250 1.11.0.12"
  },
  "referenceLink": "http://www.securityfocus.com/bid/96209",
  "serverity": "\u9ad8",
  "submitTime": "2017-02-17",
  "title": "Geutebruck G-Cam/EFD-2250\u8eab\u4efd\u8ba4\u8bc1\u7ed5\u8fc7\u6f0f\u6d1e"
}

ghsa-5jcr-qmff-jph4

Vulnerability from github

Published

2022-05-13 01:46

Modified

2025-04-20 03:37

Severity ?

9.8 (Critical) - CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Details

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2017-5174"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-288"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2017-05-19T03:29:00Z",
    "severity": "CRITICAL"
  },
  "details": "An Authentication Bypass issue was discovered in Geutebruck IP Camera G-Cam/EFD-2250 Version 1.11.0.12. An authentication bypass vulnerability has been identified. The existing file system architecture could allow attackers to bypass the access control that may allow remote code execution.",
  "id": "GHSA-5jcr-qmff-jph4",
  "modified": "2025-04-20T03:37:51Z",
  "published": "2022-05-13T01:46:01Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-5174"
    },
    {
      "type": "WEB",
      "url": "https://ics-cert.us-cert.gov/advisories/ICSA-17-045-02"
    },
    {
      "type": "WEB",
      "url": "https://www.exploit-db.com/exploits/41360"
    },
    {
      "type": "WEB",
      "url": "http://www.securityfocus.com/bid/96209"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

icsa-17-045-02

Vulnerability from csaf_cisa

Published

2017-02-14 00:00

Modified

2017-02-14 00:00

Summary

Geutebrück IP Cameras

Notes

CISA Disclaimer

This CSAF advisory was extracted from unstructured data and may contain inaccuracies. If you notice any errors, please reach out to the designated contact at CISA CSAF: central@cisa.dhs.gov

Legal Notice

All information products included in https://us-cert.cisa.gov/ics are provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. DHS does not endorse any commercial product or service, referenced in this product or otherwise. Further dissemination of this product is governed by the Traffic Light Protocol (TLP) marking in the header. For more information about TLP, see https://us-cert.cisa.gov/tlp/.

Risk evaluation

ATTENTION: Remotely exploitable/low skill level to exploit

Critical infrastructure sectors

Commercial Facilities, Energy, Healthcare and Public Health

Countries/areas deployed

Europe, United States, Australia

Company headquarters location

Windhagen, Germany

Recommended Practices

NCCIC/ICS-CERT recommends that users take defensive measures to minimize the risk of exploitation of these vulnerabilities. Specifically, users should:

Recommended Practices

ICS-CERT reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.

Recommended Practices

ICS-CERT also provides a section for control systems security recommended practices on the ICS-CERT web page. Several recommended practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.

Recommended Practices

Additional mitigation guidance and recommended practices are publicly available in the ICS -CERT Technical Information Paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies, that is available for download from the ICS-CERT web site.

Recommended Practices

Organizations observing any suspected malicious activity should follow their established internal procedures and report their findings to ICS-CERT for tracking and correlation against other incidents.

Exploitability

No known public exploits specifically target these vulnerabilities.

JSON

To clipboard

{
  "document": {
    "acknowledgments": [
      {
        "names": [
          "Florent Montel",
          "Fr\u00e9d\u00e9ric Cikala"
        ],
        "summary": "discovering the authentication bypass vulnerability"
      },
      {
        "names": [
          "DavyDouhine"
        ],
        "organization": "RandoriSec",
        "summary": "discovering the improper access control vulnerability"
      }
    ],
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Disclosure is not limited",
      "tlp": {
        "label": "WHITE",
        "url": "https://us-cert.cisa.gov/tlp/"
      }
    },
    "lang": "en-US",
    "notes": [
      {
        "category": "general",
        "text": "This CSAF advisory was extracted from unstructured data and may contain inaccuracies. If you notice any errors, please reach out to the designated contact at CISA CSAF: central@cisa.dhs.gov",
        "title": "CISA Disclaimer"
      },
      {
        "category": "legal_disclaimer",
        "text": "All information products included in https://us-cert.cisa.gov/ics are provided \"as is\" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. DHS does not endorse any commercial product or service, referenced in this product or otherwise. Further dissemination of this product is governed by the Traffic Light Protocol (TLP) marking in the header. For more information about TLP, see https://us-cert.cisa.gov/tlp/.",
        "title": "Legal Notice"
      },
      {
        "category": "summary",
        "text": "ATTENTION: Remotely exploitable/low skill level to exploit",
        "title": "Risk evaluation"
      },
      {
        "category": "other",
        "text": "Commercial Facilities, Energy, Healthcare and Public Health",
        "title": "Critical infrastructure sectors"
      },
      {
        "category": "other",
        "text": "Europe, United States, Australia",
        "title": "Countries/areas deployed"
      },
      {
        "category": "other",
        "text": "Windhagen, Germany",
        "title": "Company headquarters location"
      },
      {
        "category": "general",
        "text": "NCCIC/ICS-CERT recommends that users take defensive measures to minimize the risk of exploitation of these vulnerabilities. Specifically, users should:",
        "title": "Recommended Practices"
      },
      {
        "category": "general",
        "text": "ICS-CERT reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.",
        "title": "Recommended Practices"
      },
      {
        "category": "general",
        "text": "ICS-CERT also provides a section for control systems security recommended practices on the ICS-CERT web page. Several recommended practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.",
        "title": "Recommended Practices"
      },
      {
        "category": "general",
        "text": "Additional mitigation guidance and recommended practices are publicly available in the ICS -CERT Technical Information Paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies, that is available for download from the ICS-CERT web site.",
        "title": "Recommended Practices"
      },
      {
        "category": "general",
        "text": "Organizations observing any suspected malicious activity should follow their established internal procedures and report their findings to ICS-CERT for tracking and correlation against other incidents.",
        "title": "Recommended Practices"
      },
      {
        "category": "other",
        "text": "No known public exploits specifically target these vulnerabilities.",
        "title": "Exploitability"
      }
    ],
    "publisher": {
      "category": "coordinator",
      "contact_details": "Email: CISAservicedesk@cisa.dhs.gov;\n Toll Free: 1-888-282-0870",
      "name": "CISA",
      "namespace": "https://www.cisa.gov/"
    },
    "references": [
      {
        "category": "self",
        "summary": "ICS Advisory ICSA-17-045-02 JSON",
        "url": "https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/OT/white/2017/icsa-17-045-02.json"
      },
      {
        "category": "self",
        "summary": "ICS Advisory ICSA-17-045-02 Web Version",
        "url": "https://www.cisa.gov/news-events/ics-advisories/icsa-17-045-02"
      },
      {
        "category": "external",
        "summary": "Recommended Practices",
        "url": "https://www.cisa.gov/news-events/ics-advisories/icsa-17-045-02"
      }
    ],
    "title": "Geutebr\u00fcck IP Cameras",
    "tracking": {
      "current_release_date": "2017-02-14T00:00:00.000000Z",
      "generator": {
        "engine": {
          "name": "CISA CSAF Generator",
          "version": "1.0.0"
        }
      },
      "id": "ICSA-17-045-02",
      "initial_release_date": "2017-02-14T00:00:00.000000Z",
      "revision_history": [
        {
          "date": "2017-02-14T00:00:00.000000Z",
          "legacy_version": "Initial",
          "number": "1",
          "summary": "ICSA-17-045-02 Geutebruck IP Cameras"
        }
      ],
      "status": "final",
      "version": "1"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "1.11.0.12",
                "product": {
                  "name": "G-Cam/EFD-2250: Version 1.11.0.12",
                  "product_id": "CSAFPID-0001"
                }
              }
            ],
            "category": "product_name",
            "name": "G-Cam/EFD-2250"
          }
        ],
        "category": "vendor",
        "name": "Geutebr\u00c3\u00bcck"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2017-5174",
      "cwe": {
        "id": "CWE-288",
        "name": "Authentication Bypass Using an Alternate Path or Channel"
      },
      "notes": [
        {
          "category": "summary",
          "text": "An authentication bypass vulnerability has been identified. The existing file system architecture could allow attackers to bypass the access control that may allow remote code execution.CVE-2017-5174 has been assigned to this vulnerability. A CVSS v3 base score of 9.8 has been assigned; the CVSS vector string is (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).",
          "title": "Vulnerability Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0001"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "web.nvd.nist.gov",
          "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2017-5174"
        },
        {
          "category": "external",
          "summary": "www.first.org",
          "url": "https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
        }
      ],
      "remediations": [
        {
          "category": "mitigation",
          "details": "Geutebr\u00fcck recommends customers download and update with the newest patch from this location by registering for a new web club account or logging into an existing account.",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "http://www.geutebrueck.com/en_EN/login.html"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.0"
          },
          "products": [
            "CSAFPID-0001"
          ]
        }
      ]
    },
    {
      "cve": "CVE-2017-5173",
      "cwe": {
        "id": "CWE-78",
        "name": "Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)"
      },
      "notes": [
        {
          "category": "summary",
          "text": "An improper neutralization of special elements vulnerability has been identified. If special elements are not properly neutralized, an attacker can call multiple parameters that can allow access to the root level operating system which could allow remote code execution.CVE-2017-5173 has been assigned to this vulnerability. A CVSS v3 base score of 9.8 has been assigned; the CVSS vector string is (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).",
          "title": "Vulnerability Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0001"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "web.nvd.nist.gov",
          "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2017-5173"
        },
        {
          "category": "external",
          "summary": "www.first.org",
          "url": "https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
        }
      ],
      "remediations": [
        {
          "category": "mitigation",
          "details": "Geutebr\u00fcck recommends customers download and update with the newest patch from this location by registering for a new web club account or logging into an existing account.",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "http://www.geutebrueck.com/en_EN/login.html"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.0"
          },
          "products": [
            "CSAFPID-0001"
          ]
        }
      ]
    }
  ]
}

ICSA-17-045-02

Vulnerability from csaf_cisa

Published

2017-02-14 00:00

Modified

2017-02-14 00:00

Summary

Geutebrück IP Cameras

Notes

CISA Disclaimer

This CSAF advisory was extracted from unstructured data and may contain inaccuracies. If you notice any errors, please reach out to the designated contact at CISA CSAF: central@cisa.dhs.gov

Legal Notice

Risk evaluation

ATTENTION: Remotely exploitable/low skill level to exploit

Critical infrastructure sectors

Commercial Facilities, Energy, Healthcare and Public Health

Countries/areas deployed

Europe, United States, Australia

Company headquarters location

Windhagen, Germany

Recommended Practices

NCCIC/ICS-CERT recommends that users take defensive measures to minimize the risk of exploitation of these vulnerabilities. Specifically, users should:

Recommended Practices

ICS-CERT reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.

Recommended Practices

Exploitability

No known public exploits specifically target these vulnerabilities.

JSON

To clipboard

{
  "document": {
    "acknowledgments": [
      {
        "names": [
          "Florent Montel",
          "Fr\u00e9d\u00e9ric Cikala"
        ],
        "summary": "discovering the authentication bypass vulnerability"
      },
      {
        "names": [
          "DavyDouhine"
        ],
        "organization": "RandoriSec",
        "summary": "discovering the improper access control vulnerability"
      }
    ],
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Disclosure is not limited",
      "tlp": {
        "label": "WHITE",
        "url": "https://us-cert.cisa.gov/tlp/"
      }
    },
    "lang": "en-US",
    "notes": [
      {
        "category": "general",
        "text": "This CSAF advisory was extracted from unstructured data and may contain inaccuracies. If you notice any errors, please reach out to the designated contact at CISA CSAF: central@cisa.dhs.gov",
        "title": "CISA Disclaimer"
      },
      {
        "category": "legal_disclaimer",
        "text": "All information products included in https://us-cert.cisa.gov/ics are provided \"as is\" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. DHS does not endorse any commercial product or service, referenced in this product or otherwise. Further dissemination of this product is governed by the Traffic Light Protocol (TLP) marking in the header. For more information about TLP, see https://us-cert.cisa.gov/tlp/.",
        "title": "Legal Notice"
      },
      {
        "category": "summary",
        "text": "ATTENTION: Remotely exploitable/low skill level to exploit",
        "title": "Risk evaluation"
      },
      {
        "category": "other",
        "text": "Commercial Facilities, Energy, Healthcare and Public Health",
        "title": "Critical infrastructure sectors"
      },
      {
        "category": "other",
        "text": "Europe, United States, Australia",
        "title": "Countries/areas deployed"
      },
      {
        "category": "other",
        "text": "Windhagen, Germany",
        "title": "Company headquarters location"
      },
      {
        "category": "general",
        "text": "NCCIC/ICS-CERT recommends that users take defensive measures to minimize the risk of exploitation of these vulnerabilities. Specifically, users should:",
        "title": "Recommended Practices"
      },
      {
        "category": "general",
        "text": "ICS-CERT reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.",
        "title": "Recommended Practices"
      },
      {
        "category": "general",
        "text": "ICS-CERT also provides a section for control systems security recommended practices on the ICS-CERT web page. Several recommended practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.",
        "title": "Recommended Practices"
      },
      {
        "category": "general",
        "text": "Additional mitigation guidance and recommended practices are publicly available in the ICS -CERT Technical Information Paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies, that is available for download from the ICS-CERT web site.",
        "title": "Recommended Practices"
      },
      {
        "category": "general",
        "text": "Organizations observing any suspected malicious activity should follow their established internal procedures and report their findings to ICS-CERT for tracking and correlation against other incidents.",
        "title": "Recommended Practices"
      },
      {
        "category": "other",
        "text": "No known public exploits specifically target these vulnerabilities.",
        "title": "Exploitability"
      }
    ],
    "publisher": {
      "category": "coordinator",
      "contact_details": "Email: CISAservicedesk@cisa.dhs.gov;\n Toll Free: 1-888-282-0870",
      "name": "CISA",
      "namespace": "https://www.cisa.gov/"
    },
    "references": [
      {
        "category": "self",
        "summary": "ICS Advisory ICSA-17-045-02 JSON",
        "url": "https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/OT/white/2017/icsa-17-045-02.json"
      },
      {
        "category": "self",
        "summary": "ICS Advisory ICSA-17-045-02 Web Version",
        "url": "https://www.cisa.gov/news-events/ics-advisories/icsa-17-045-02"
      },
      {
        "category": "external",
        "summary": "Recommended Practices",
        "url": "https://www.cisa.gov/news-events/ics-advisories/icsa-17-045-02"
      }
    ],
    "title": "Geutebr\u00fcck IP Cameras",
    "tracking": {
      "current_release_date": "2017-02-14T00:00:00.000000Z",
      "generator": {
        "engine": {
          "name": "CISA CSAF Generator",
          "version": "1.0.0"
        }
      },
      "id": "ICSA-17-045-02",
      "initial_release_date": "2017-02-14T00:00:00.000000Z",
      "revision_history": [
        {
          "date": "2017-02-14T00:00:00.000000Z",
          "legacy_version": "Initial",
          "number": "1",
          "summary": "ICSA-17-045-02 Geutebruck IP Cameras"
        }
      ],
      "status": "final",
      "version": "1"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "1.11.0.12",
                "product": {
                  "name": "G-Cam/EFD-2250: Version 1.11.0.12",
                  "product_id": "CSAFPID-0001"
                }
              }
            ],
            "category": "product_name",
            "name": "G-Cam/EFD-2250"
          }
        ],
        "category": "vendor",
        "name": "Geutebr\u00c3\u00bcck"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2017-5174",
      "cwe": {
        "id": "CWE-288",
        "name": "Authentication Bypass Using an Alternate Path or Channel"
      },
      "notes": [
        {
          "category": "summary",
          "text": "An authentication bypass vulnerability has been identified. The existing file system architecture could allow attackers to bypass the access control that may allow remote code execution.CVE-2017-5174 has been assigned to this vulnerability. A CVSS v3 base score of 9.8 has been assigned; the CVSS vector string is (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).",
          "title": "Vulnerability Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0001"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "web.nvd.nist.gov",
          "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2017-5174"
        },
        {
          "category": "external",
          "summary": "www.first.org",
          "url": "https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
        }
      ],
      "remediations": [
        {
          "category": "mitigation",
          "details": "Geutebr\u00fcck recommends customers download and update with the newest patch from this location by registering for a new web club account or logging into an existing account.",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "http://www.geutebrueck.com/en_EN/login.html"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.0"
          },
          "products": [
            "CSAFPID-0001"
          ]
        }
      ]
    },
    {
      "cve": "CVE-2017-5173",
      "cwe": {
        "id": "CWE-78",
        "name": "Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)"
      },
      "notes": [
        {
          "category": "summary",
          "text": "An improper neutralization of special elements vulnerability has been identified. If special elements are not properly neutralized, an attacker can call multiple parameters that can allow access to the root level operating system which could allow remote code execution.CVE-2017-5173 has been assigned to this vulnerability. A CVSS v3 base score of 9.8 has been assigned; the CVSS vector string is (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).",
          "title": "Vulnerability Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0001"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "web.nvd.nist.gov",
          "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2017-5173"
        },
        {
          "category": "external",
          "summary": "www.first.org",
          "url": "https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
        }
      ],
      "remediations": [
        {
          "category": "mitigation",
          "details": "Geutebr\u00fcck recommends customers download and update with the newest patch from this location by registering for a new web club account or logging into an existing account.",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "http://www.geutebrueck.com/en_EN/login.html"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.0"
          },
          "products": [
            "CSAFPID-0001"
          ]
        }
      ]
    }
  ]
}

gsd-2017-5174

Vulnerability from gsd

Modified

2023-12-13 01:21

Details

Aliases

CVE-2017-5174

Aliases

CVE-2017-5174

JSON

To clipboard

{
  "GSD": {
    "alias": "CVE-2017-5174",
    "description": "An Authentication Bypass issue was discovered in Geutebruck IP Camera G-Cam/EFD-2250 Version 1.11.0.12. An authentication bypass vulnerability has been identified. The existing file system architecture could allow attackers to bypass the access control that may allow remote code execution.",
    "id": "GSD-2017-5174",
    "references": [
      "https://packetstormsecurity.com/files/cve/CVE-2017-5174"
    ]
  },
  "gsd": {
    "metadata": {
      "exploitCode": "unknown",
      "remediation": "unknown",
      "reportConfidence": "confirmed",
      "type": "vulnerability"
    },
    "osvSchema": {
      "aliases": [
        "CVE-2017-5174"
      ],
      "details": "An Authentication Bypass issue was discovered in Geutebruck IP Camera G-Cam/EFD-2250 Version 1.11.0.12. An authentication bypass vulnerability has been identified. The existing file system architecture could allow attackers to bypass the access control that may allow remote code execution.",
      "id": "GSD-2017-5174",
      "modified": "2023-12-13T01:21:13.593989Z",
      "schema_version": "1.4.0"
    }
  },
  "namespaces": {
    "cve.org": {
      "CVE_data_meta": {
        "ASSIGNER": "ics-cert@hq.dhs.gov",
        "ID": "CVE-2017-5174",
        "STATE": "PUBLIC"
      },
      "affects": {
        "vendor": {
          "vendor_data": [
            {
              "product": {
                "product_data": [
                  {
                    "product_name": "Geutebruck IP Cameras",
                    "version": {
                      "version_data": [
                        {
                          "version_value": "Geutebruck IP Cameras"
                        }
                      ]
                    }
                  }
                ]
              },
              "vendor_name": "n/a"
            }
          ]
        }
      },
      "data_format": "MITRE",
      "data_type": "CVE",
      "data_version": "4.0",
      "description": {
        "description_data": [
          {
            "lang": "eng",
            "value": "An Authentication Bypass issue was discovered in Geutebruck IP Camera G-Cam/EFD-2250 Version 1.11.0.12. An authentication bypass vulnerability has been identified. The existing file system architecture could allow attackers to bypass the access control that may allow remote code execution."
          }
        ]
      },
      "problemtype": {
        "problemtype_data": [
          {
            "description": [
              {
                "lang": "eng",
                "value": "CWE-288"
              }
            ]
          }
        ]
      },
      "references": {
        "reference_data": [
          {
            "name": "96209",
            "refsource": "BID",
            "url": "http://www.securityfocus.com/bid/96209"
          },
          {
            "name": "https://ics-cert.us-cert.gov/advisories/ICSA-17-045-02",
            "refsource": "MISC",
            "url": "https://ics-cert.us-cert.gov/advisories/ICSA-17-045-02"
          },
          {
            "name": "41360",
            "refsource": "EXPLOIT-DB",
            "url": "https://www.exploit-db.com/exploits/41360/"
          }
        ]
      }
    },
    "nvd.nist.gov": {
      "configurations": {
        "CVE_data_version": "4.0",
        "nodes": [
          {
            "children": [
              {
                "children": [],
                "cpe_match": [
                  {
                    "cpe23Uri": "cpe:2.3:o:geutebruck:ip_camera_g-cam_efd-2250_firmware:1.11.0.12:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": true
                  }
                ],
                "operator": "OR"
              },
              {
                "children": [],
                "cpe_match": [
                  {
                    "cpe23Uri": "cpe:2.3:h:geutebruck:ip_camera_g-cam_efd-2250:-:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": false
                  }
                ],
                "operator": "OR"
              }
            ],
            "cpe_match": [],
            "operator": "AND"
          }
        ]
      },
      "cve": {
        "CVE_data_meta": {
          "ASSIGNER": "ics-cert@hq.dhs.gov",
          "ID": "CVE-2017-5174"
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "en",
              "value": "An Authentication Bypass issue was discovered in Geutebruck IP Camera G-Cam/EFD-2250 Version 1.11.0.12. An authentication bypass vulnerability has been identified. The existing file system architecture could allow attackers to bypass the access control that may allow remote code execution."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "en",
                  "value": "NVD-CWE-noinfo"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://ics-cert.us-cert.gov/advisories/ICSA-17-045-02",
              "refsource": "MISC",
              "tags": [
                "Third Party Advisory",
                "US Government Resource"
              ],
              "url": "https://ics-cert.us-cert.gov/advisories/ICSA-17-045-02"
            },
            {
              "name": "96209",
              "refsource": "BID",
              "tags": [
                "Third Party Advisory",
                "VDB Entry"
              ],
              "url": "http://www.securityfocus.com/bid/96209"
            },
            {
              "name": "41360",
              "refsource": "EXPLOIT-DB",
              "tags": [],
              "url": "https://www.exploit-db.com/exploits/41360/"
            }
          ]
        }
      },
      "impact": {
        "baseMetricV2": {
          "acInsufInfo": true,
          "cvssV2": {
            "accessComplexity": "LOW",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "availabilityImpact": "PARTIAL",
            "baseScore": 7.5,
            "confidentialityImpact": "PARTIAL",
            "integrityImpact": "PARTIAL",
            "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
            "version": "2.0"
          },
          "exploitabilityScore": 10.0,
          "impactScore": 6.4,
          "obtainAllPrivilege": false,
          "obtainOtherPrivilege": false,
          "obtainUserPrivilege": false,
          "severity": "HIGH",
          "userInteractionRequired": false
        },
        "baseMetricV3": {
          "cvssV3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.0"
          },
          "exploitabilityScore": 3.9,
          "impactScore": 5.9
        }
      },
      "lastModifiedDate": "2019-10-03T00:03Z",
      "publishedDate": "2017-05-19T03:29Z"
    }
  }
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
Confirmed: The vulnerability is confirmed from an analyst perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
Patched: This vulnerability was successfully patched by the user reporting the sighting.
Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
Not confirmed: The user expresses doubt about the veracity of the vulnerability.
Not patched: This vulnerability was not successfully patched by the user reporting the sighting.

Action not permitted

CVE-2017-5174 (GCVE-0-2017-5174)

Vulnerability from cvelistv5

var-201705-3256

Vulnerability from variot

fkie_cve-2017-5174

Vulnerability from fkie_nvd

cnvd-2017-01888

Vulnerability from cnvd

ghsa-5jcr-qmff-jph4

Vulnerability from github

icsa-17-045-02

Vulnerability from csaf_cisa

ICSA-17-045-02

Vulnerability from csaf_cisa

gsd-2017-5174

Vulnerability from gsd

Tags

Sightings

Nomenclature