An issue exists in upgrade_firmware.cgi on VStarcam 100T (C7824WIP) CH-sys-48.53.75.119~123 and 200V (C38S) CH-sys-48.53.203.119~123 devices. A remote command can be executed through a system firmware update without authentication. The attacker can modify the files within the internal firmware or even steal account information by executing a command.
Vulnerable Product | Search on Vulmon | Subscribe to Product |
---|---|---|
vstracam c7824wip_firmware ch-sys-48.53.75.119\\~123 |
||
vstracam c38s_firmware ch-sys-48.53.203.119\\~123 |