CWE Code: 77
Vulnerability Type: privilege_escalation
CVSS Score: 9.0
CWE Name:  Improper Neutralization of Special Elements used in a Command ('Command Injection')
Summary: a command-injection vulnerability exists in a web application on a custom-built goahead web server used on foscam, vstarcam, and multiple white-label ip camera models. the mail-sending form in the mail.htm page allows an attacker to inject a command into the receiver1 field in the form; it will be executed with root privileges.
Access Authentication: SINGLE
Access Complexity: LOW
Access Vector: NETWORK
Impact (C/I/A): COMPLETE/COMPLETE/COMPLETE
Published Date: 2017-03-13
Last Modified Date: 2017-03-15