Vulnerability Spotlight: Multiple Foscam C1 Vulnerabilities Come in to Focus
Summary: Cisco Talos disclosed multiple vulnerabilities in Foscam C1 Indoor HD Cameras, including undocumented hardcoded FTP credentials (CVE-2016-8731) that allow remote login and full read/write access to the device's Micro-SD card, plus a series of buffer overflow, command injection and directory traversal flaws in the CGIProxy.fcgi web management service. Talos worked with Foscam under its responsible disclosure policy, resulting in a firmware update addressing the issues.
What you should know: The hardcoded FTP credentials require no administrative access at all, so anyone who knows them can pull stored audio and video recordings off the camera's Micro-SD card - and the remaining flaws in the web management interface, several reachable through crafted HTTP requests, put code execution on the same device.
Read the original at Cisco Talos ↗
- Topics
- Vulnerabilities & Patching
- Mentions
- CVE-2016-8731CVE-2017-2805CVE-2017-2827CVE-2017-2828CVE-2017-2829CVE-2017-2830
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026