CVE-2022-28743

Time-of-check Time-of-use (TOCTOU) Race Condition vulerability in Foscam R2C IP camera running System FW <= 1.13.1.6, and Application FW <= 2.91.2.66, allows an authenticated remote attacker with administrator permissions to execute arbitrary remote code via a malicious firmware patch. The impact of this vulnerability is that the remote attacker could gain full remote access to the IP camera and the underlying Linux system with root permissions. With root access to the camera's Linux OS, an attacker could effectively change the code that is running, add backdoor access, or invade the privacy of the user by accessing the live camera stream.

• CWE-367

• https://www.trellix.com/en-us/about/newsroom/stories/threat-labs/keeping-a-critical-eye-on-iot-devices.htmlThird Party Advisory
• https://www.trellix.com/en-us/about/newsroom/stories/threat-labs/keeping-a-critical-eye-on-iot-devices.htmlThird Party Advisory

Published

Apr 21, 2022

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-28738A double free was found in the Regexp compiler in Ruby 3.x b…9.8
• CVE-2022-28739There is a buffer over-read in Ruby before 2.6.10, 2.7.x bef…7.5
• CVE-2022-2874NULL Pointer Dereference in GitHub repository vim/vim prior …5.5
• CVE-2022-28740aEnrich eHRD Learning Management Key Performance Indicator S…7.5
• CVE-2022-28741aEnrich a+HRD 5.x Learning Management Key Performance Indica…8.1
• CVE-2022-28742aEnrich eHRD Learning Management Key Performance Indicator S…7.5
• CVE-2022-28747Key reuse in GoSecure Titan Inbox Detection & Response (IDR)…9.8
• CVE-2022-28748Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2022-28749Zooms On-Premise Meeting Connector MMR before version 4.8.11…4.3
• CVE-2022-28750Zoom On-Premise Meeting Connector Zone Controller (ZC) befor…9.8
• CVE-2022-28751The Zoom Client for Meetings for MacOS (Standard and for IT …7.8
• CVE-2022-28752Zoom Rooms for Conference Rooms for Windows versions before …7.8