CVE-2021-26614

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

ius_get.cgi in IpTime C200 camera allows remote code execution. A remote attacker may send a crafted parameters to the exposed vulnerable web service interface which invokes the arbitrary shell command.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-749

Affected software

Vendor	Product	Versions
EFM networks & multimedia	ipTIME C200 IP Camera	>= 1.058, <= 1.058

References

https://www.boho.or.kr/krcert/secNoticeView.do?bulletin_writing_sequence=36346Third Party Advisory
https://www.boho.or.kr/krcert/secNoticeView.do?bulletin_writing_sequence=36346Third Party Advisory

Timeline

Published: Nov 22, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-266158.8ARK library allows attackers to execute remote code via the parameter(path value) of Ark_NormalizeAndDupPAthNameW function because of an int CVE-2021-266169.8An OS command injection was found in SecuwaySSL, when special characters injection on execute command with runCommand arguments.CVE-2021-266179.8This issues due to insufficient verification of the various input values from user’s input. The vulnerability allows remote attackers to exe CVE-2021-266189.8An improper input validation leading to arbitrary file creation was discovered in ToWord of ToOffice. Remote attackers use this vulnerabilit CVE-2021-266199.1An path traversal vulnerability leading to delete arbitrary files was discovered in BigFileAgent. Remote attackers can use this vulnerabilit CVE-2021-266207.5An improper authentication vulnerability leading to information leakage was discovered in iptime NAS2dual. Remote attackers are able to stea CVE-2021-266219.8An Buffer Overflow vulnerability leading to remote code execution was discovered in MEX01. Remote attackers can use this vulnerability by us CVE-2021-2662210.0An remote code execution vulnerability due to SSTI vulnerability and insufficient file name parameter validation was discovered in Genian NA CVE-2021-266239.8A remote code execution vulnerability due to incomplete check for 'xheader_decode_path_record' function's parameter length value in the ark CVE-2021-266248.8An local privilege escalation vulnerability due to a "runasroot" command in eScan Anti-Virus. This vulnerability is due to invalid arguments CVE-2021-266258.8Insufficient Verification of input Data leading to arbitrary file download and execute was discovered in Nexacro platform. This vulnerabilit CVE-2021-266268.8Improper input validation vulnerability in XPLATFORM's execBrowser method can cause execute arbitrary commands. IF the second parameter valu