FOSCAM Wireless IP Camera Cross Site Scripting

2013.11.08
Credit: Liad Mizrachi
Risk: Low
Local: No
Remote: No
CVE: CVE-2013-5215
CWE: CWE-79


CVSS Base Score: 4.3/10
Impact Subscore: 2.9/10
Exploitability Subscore: 8.6/10
Exploit range: Remote
Attack complexity: Medium
Authentication: No required
Confidentiality impact: None
Integrity impact: Partial
Availability impact: None

Advisory: FOSCAM Wireless IP Camera - SSID XSS Author: Liad Mizrachi Vendor URL: http://www.foscam.com/ Vulnerability Status: No Fix CVE-ID: CVE-2013-5215 ========================== Vulnerability Description ========================== FOSCAM's Web UI "WiFi scan" option is vulnerable to XSS using a custom AP SSID. ========================== PoC ========================== Setup wireless access point and set SSID with the _javascript_ code. - SSID must start with ' (Apostrophe). - SSID must end with // (comment). ========================== Disclosure Timeline ========================== 20-Aug-2013 - Vendor informed by mail 21-Aug-2013 - Reply from FosCam Support, moved to R&D team. 08-Sep-2013 - Requesting the vendor for update on the issue. 08-Sep-2013 - Reply From Vendor: no fix will be issue. ========================== References ==========================http://www.foscam.com/https://vimeo.com/72786679 [PoC Demo]

References:

http://www.foscam.com/
https://vimeo.com/72786679


See this note in RAW Version
Vote for this issue:
50%
50%


 

Thanks for you vote!


 

Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.


(*) - required fields.  
{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1
{{ x.comment }}
Copyright 2024, cxsecurity.com

 

Back to Top