/cgi-bin/wapopen in Boa 0.94.14rc21 allows the injection of "../.." using the FILECAMERA variable (sent by GET) to read files with root privileges. NOTE: multiple third parties report that this is a system-integrator issue (e.g., a vulnerability on one type of camera) because Boa does not include any wapopen program or any code to read a FILECAMERA variable.
References
| Link | Resource |
|---|---|
| https://pastebin.com/raw/rt7LJvyF | Exploit Third Party Advisory |
| https://www.exploit-db.com/exploits/42290/ | Exploit Third Party Advisory VDB Entry |
| https://pastebin.com/raw/rt7LJvyF | Exploit Third Party Advisory |
| https://www.exploit-db.com/exploits/42290/ | Exploit Third Party Advisory VDB Entry |
Configurations
History
21 Nov 2024, 03:36
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://pastebin.com/raw/rt7LJvyF - Exploit, Third Party Advisory | |
| References | () https://www.exploit-db.com/exploits/42290/ - Exploit, Third Party Advisory, VDB Entry |
07 Nov 2023, 02:50
| Type | Values Removed | Values Added |
|---|---|---|
| Summary | /cgi-bin/wapopen in Boa 0.94.14rc21 allows the injection of "../.." using the FILECAMERA variable (sent by GET) to read files with root privileges. NOTE: multiple third parties report that this is a system-integrator issue (e.g., a vulnerability on one type of camera) because Boa does not include any wapopen program or any code to read a FILECAMERA variable. |
Information
Published : 2017-06-24 02:29
Updated : 2025-04-20 01:37
NVD link : CVE-2017-9833
Mitre link : CVE-2017-9833
CVE.ORG link : CVE-2017-9833
JSON object : View
Products Affected
boa
- boa
CWE
CWE-22
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')