CVE-2018-17879
CRITICALCVSS 9.8/10EPSS 21.85%
Last modified
CVE-2018-17879 is a critical-severity vulnerability rated 9.8/10 on the CVSS scale. An issue was discovered on certain ABUS TVIP cameras. The CGI scripts allow remote attackers to execute code via system() as root. EPSS estimates a 21.85% chance of exploitation in the next 30 days.
Description
An issue was discovered on certain ABUS TVIP cameras. The CGI scripts allow remote attackers to execute code via system() as root. There are several injection points in various scripts.
Metrics
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Abus | Tvip 10000 Firmware | All versions |
| Abus | Tvip 10001 Firmware | All versions |
| Abus | Tvip 10005 Firmware | All versions |
| Abus | Tvip 10005a Firmware | All versions |
| Abus | Tvip 10005b Firmware | All versions |
| Abus | Tvip 10050 Firmware | All versions |
| Abus | Tvip 10051 Firmware | All versions |
| Abus | Tvip 10055a Firmware | All versions |
| Abus | Tvip 10055b Firmware | All versions |
| Abus | Tvip 10500 Firmware | All versions |
| Abus | Tvip 10550 Firmware | All versions |
| Abus | Tvip 11000 Firmware | All versions |
| Abus | Tvip 11050 Firmware | All versions |
| Abus | Tvip 11500 Firmware | All versions |
| Abus | Tvip 11501 Firmware | All versions |
| Abus | Tvip 11502 Firmware | All versions |
| Abus | Tvip 11550 Firmware | All versions |
| Abus | Tvip 11551 Firmware | All versions |
| Abus | Tvip 11552 Firmware | All versions |
| Abus | Tvip 20000 Firmware | All versions |
| Abus | Tvip 20050 Firmware | All versions |
| Abus | Tvip 20500 Firmware | All versions |
| Abus | Tvip 20550 Firmware | All versions |
| Abus | Tvip 21000 Firmware | All versions |
| Abus | Tvip 21050 Firmware | All versions |
| Abus | Tvip 21500 Firmware | All versions |
| Abus | Tvip 21501 Firmware | All versions |
| Abus | Tvip 21502 Firmware | All versions |
| Abus | Tvip 21550 Firmware | All versions |
| Abus | Tvip 21551 Firmware | All versions |
| Abus | Tvip 21552 Firmware | All versions |
| Abus | Tvip 22500 Firmware | All versions |
| Abus | Tvip 31000 Firmware | All versions |
| Abus | Tvip 31001 Firmware | All versions |
| Abus | Tvip 31050 Firmware | All versions |
| Abus | Tvip 31500 Firmware | All versions |
| Abus | Tvip 31501 Firmware | All versions |
| Abus | Tvip 31550 Firmware | All versions |
| Abus | Tvip 31551 Firmware | All versions |
| Abus | Tvip 32500 Firmware | All versions |
| Abus | Tvip 51500 Firmware | All versions |
| Abus | Tvip 51550 Firmware | All versions |
| Abus | Tvip 71500 Firmware | All versions |
| Abus | Tvip 71501 Firmware | All versions |
| Abus | Tvip 71550 Firmware | All versions |
| Abus | Tvip 71551 Firmware | All versions |
| Abus | Tvip 72500 Firmware | All versions |
References
- https://sec.maride.cc/posts/abus/#cve-2018-17879Exploit, Third Party Advisory
- https://sec.maride.cc/posts/abus/#cve-2018-17879Exploit, Third Party Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2018-17879?
An issue was discovered on certain ABUS TVIP cameras. The CGI scripts allow remote attackers to execute code via system() as root. There are several injection points in various scripts.
How severe is CVE-2018-17879?
CVE-2018-17879 has a CVSS score of 9.8/10 (CRITICAL severity). The EPSS model estimates a 21.85% probability of exploitation in the next 30 days.
How do I fix CVE-2018-17879?
Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2018
- CVE-2018-17873An incorrect access control vulnerability in the FTP configu…
- CVE-2018-17874ExpressionEngine before 4.3.5 has reflected XSS.
- CVE-2018-17875A remote code execution issue in the ping command on Poly Tr…8.8
- CVE-2018-17876A Stored XSS vulnerability has been discovered in the v5.5.0…
- CVE-2018-17877A lottery smart contract implementation for Greedy 599, an E…
- CVE-2018-17878Buffer Overflow vulnerability in certain ABUS TVIP cameras a…9.8
- CVE-2018-1788IBM Spectrum Protect Server 7.1 and 8.1 could disclose highl…4.1
- CVE-2018-17880On D-Link DIR-823G 2018-09-19 devices, the GoAhead configura…
- CVE-2018-17881On D-Link DIR-823G 2018-09-19 devices, the GoAhead configura…
- CVE-2018-17882An Integer overflow vulnerability exists in the batchTransfe…
- CVE-2018-17883An issue was discovered in Open Ticket Request System (OTRS)…6.1
- CVE-2018-17884XSS exists in admin/gb-dashboard-widget.php in the Gwolle Gu…
Are you affected by CVE-2018-17879?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST