CVE-2018-17879

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

An issue was discovered on certain ABUS TVIP cameras. The CGI scripts allow remote attackers to execute code via system() as root. There are several injection points in various scripts.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-78

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://sec.maride.cc/posts/abus/#cve-2018-17879Exploit, Third Party Advisory
https://www.ccc.de/en/updates/2019/update-nicht-verfugbar-hersteller-nicht-zu-erreichenThird Party Advisory
https://sec.maride.cc/posts/abus/#cve-2018-17879Exploit, Third Party Advisory
https://www.ccc.de/en/updates/2019/update-nicht-verfugbar-hersteller-nicht-zu-erreichenThird Party Advisory

Timeline

Published: Oct 26, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2018

CVE-2018-17884.4IBM Spectrum Protect Server 7.1 and 8.1 could disclose highly sensitive information via trace logs to a local privileged user. IBM X-Force I CVE-2018-178807.5On D-Link DIR-823G 2018-09-19 devices, the GoAhead configuration allows /HNAP1 RunReboot commands without authentication to trigger a reboot CVE-2018-178819.8On D-Link DIR-823G 2018-09-19 devices, the GoAhead configuration allows /HNAP1 SetPasswdSettings commands without authentication to trigger CVE-2018-178827.5An Integer overflow vulnerability exists in the batchTransfer function of a smart contract implementation for CryptoBotsBattle (CBTB), an Et CVE-2018-178836.1An issue was discovered in Open Ticket Request System (OTRS) 6.0.x before 6.0.12. An attacker could send an e-mail message with a malicious CVE-2018-178846.1XSS exists in admin/gb-dashboard-widget.php in the Gwolle Guestbook (gwolle-gb) plugin before 2.5.4 for WordPress via the PATH_INFO to wp-ad CVE-2018-178865.4An issue was discovered in JEESNS 1.3. The XSS filter in com.lxinet.jeesns.core.utils.XssHttpServletRequestWrapper.java could be bypassed, a CVE-2018-178889.8NUUO CMS all versions 3.1 and prior, The application uses a session identification mechanism that could allow attackers to obtain the active CVE-2018-178895.3In WECON Technology Co., Ltd. PI Studio HMI versions 4.1.9 and prior and PI Studio versions 4.2.34 and prior when parsing project files, the CVE-2018-17899.9IBM API Connect v2018.1.0 through v2018.3.4 could allow an attacker to send a specially crafted request to conduct a server side request for CVE-2018-178909.8NUUO CMS all versions 3.1 and prior, The application uses insecure and outdated software components for functionality, which could allow arb CVE-2018-178913.7Carestream Vue RIS, RIS Client Builds: Version 11.2 and prior running on a Windows 8.1 machine with IIS/7.5. When contacting a Carestream se