CVE-2018-17558 : Hardcoded manufacturer credentials and an OS command injection vulnerability in

Hardcoded manufacturer credentials and an OS command injection vulnerability in the /cgi-bin/mft/ directory on ABUS TVIP TVIP20050 LM.1.6.18, TVIP10051 LM.1.6.18, TVIP11050 MG.1.6.03.05, TVIP20550 LM.1.6.18, TVIP10050 LM.1.6.18, TVIP11550 MG.1.6.03, TVIP21050 MG.1.6.03, and TVIP51550 MG.1.6.03 cameras allow remote attackers to execute code as root.

Published 2023-10-26 22:15:08

Updated 2024-09-11 20:35:03

Source MITRE

View at NVD, CVE.org

Vulnerability category: Execute code

Products affected by CVE-2018-17558

Abus » Tvip 10000 Firmware » Version: N/A
cpe:2.3:o:abus:tvip_10000_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Abus » Tvip 10000 » Version: N/A
Abus » Tvip 10001 Firmware » Version: N/A
cpe:2.3:o:abus:tvip_10001_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Abus » Tvip 10001 » Version: N/A
Abus » Tvip 10005 Firmware » Version: N/A
cpe:2.3:o:abus:tvip_10005_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Abus » Tvip 10005 » Version: N/A
Abus » Tvip 10005a Firmware » Version: N/A
cpe:2.3:o:abus:tvip_10005a_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Abus » Tvip 10005a » Version: N/A
Abus » Tvip 10005b Firmware » Version: N/A
cpe:2.3:o:abus:tvip_10005b_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Abus » Tvip 10005b » Version: N/A
Abus » Tvip 10050 Firmware » Version: N/A
cpe:2.3:o:abus:tvip_10050_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Abus » Tvip 10050 » Version: N/A
Abus » Tvip 10051 Firmware » Version: N/A
cpe:2.3:o:abus:tvip_10051_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Abus » Tvip 10051 » Version: N/A
Abus » Tvip 10055a Firmware » Version: N/A
cpe:2.3:o:abus:tvip_10055a_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Abus » Tvip 10055a » Version: N/A
Abus » Tvip 10055b Firmware » Version: N/A
cpe:2.3:o:abus:tvip_10055b_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Abus » Tvip 10055b » Version: N/A
Abus » Tvip 10500 Firmware » Version: N/A
cpe:2.3:o:abus:tvip_10500_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Abus » Tvip 10500 » Version: N/A
Abus » Tvip 10550 Firmware » Version: N/A
cpe:2.3:o:abus:tvip_10550_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Abus » Tvip 10550 » Version: N/A
Abus » Tvip 11000 Firmware » Version: N/A
cpe:2.3:o:abus:tvip_11000_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Abus » Tvip 11000 » Version: N/A
Abus » Tvip 11050 Firmware » Version: N/A
cpe:2.3:o:abus:tvip_11050_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Abus » Tvip 11050 » Version: N/A
Abus » Tvip 11500 Firmware » Version: N/A
cpe:2.3:o:abus:tvip_11500_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Abus » Tvip 11500 » Version: N/A
Abus » Tvip 11501 Firmware » Version: N/A
cpe:2.3:o:abus:tvip_11501_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Abus » Tvip 11501 » Version: N/A
Abus » Tvip 11502 Firmware » Version: N/A
cpe:2.3:o:abus:tvip_11502_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Abus » Tvip 11502 » Version: N/A
Abus » Tvip 11550 Firmware » Version: N/A
cpe:2.3:o:abus:tvip_11550_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Abus » Tvip 11550 » Version: N/A
Abus » Tvip 11551 Firmware » Version: N/A
cpe:2.3:o:abus:tvip_11551_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Abus » Tvip 11551 » Version: N/A
Abus » Tvip 11552 Firmware » Version: N/A
cpe:2.3:o:abus:tvip_11552_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Abus » Tvip 11552 » Version: N/A
Abus » Tvip 20000 Firmware » Version: N/A
cpe:2.3:o:abus:tvip_20000_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Abus » Tvip 20000 » Version: N/A
Abus » Tvip 20050 Firmware » Version: N/A
cpe:2.3:o:abus:tvip_20050_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Abus » Tvip 20050 » Version: N/A
Abus » Tvip 20500 Firmware » Version: N/A
cpe:2.3:o:abus:tvip_20500_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Abus » Tvip 20500 » Version: N/A
Abus » Tvip 20550 Firmware » Version: N/A
cpe:2.3:o:abus:tvip_20550_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Abus » Tvip 20550 » Version: N/A
Abus » Tvip 21000 Firmware » Version: N/A
cpe:2.3:o:abus:tvip_21000_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Abus » Tvip 21000 » Version: N/A
Abus » Tvip 21050 Firmware » Version: N/A
cpe:2.3:o:abus:tvip_21050_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Abus » Tvip 21050 » Version: N/A
Abus » Tvip 21500 Firmware » Version: N/A
cpe:2.3:o:abus:tvip_21500_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Abus » Tvip 21500 » Version: N/A
Abus » Tvip 21501 Firmware » Version: N/A
cpe:2.3:o:abus:tvip_21501_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Abus » Tvip 21501 » Version: N/A
Abus » Tvip 21502 Firmware » Version: N/A
cpe:2.3:o:abus:tvip_21502_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Abus » Tvip 21502 » Version: N/A
Abus » Tvip 21550 Firmware » Version: N/A
cpe:2.3:o:abus:tvip_21550_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Abus » Tvip 21550 » Version: N/A
Abus » Tvip 21551 Firmware » Version: N/A
cpe:2.3:o:abus:tvip_21551_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Abus » Tvip 21551 » Version: N/A
Abus » Tvip 21552 Firmware » Version: N/A
cpe:2.3:o:abus:tvip_21552_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Abus » Tvip 21552 » Version: N/A
Abus » Tvip 22500 Firmware » Version: N/A
cpe:2.3:o:abus:tvip_22500_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Abus » Tvip 22500 » Version: N/A
Abus » Tvip 31000 Firmware » Version: N/A
cpe:2.3:o:abus:tvip_31000_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Abus » Tvip 31000 » Version: N/A
Abus » Tvip 31001 Firmware » Version: N/A
cpe:2.3:o:abus:tvip_31001_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Abus » Tvip 31001 » Version: N/A
Abus » Tvip 31050 Firmware » Version: N/A
cpe:2.3:o:abus:tvip_31050_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Abus » Tvip 31050 » Version: N/A
Abus » Tvip 31500 Firmware » Version: N/A
cpe:2.3:o:abus:tvip_31500_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Abus » Tvip 31500 » Version: N/A
Abus » Tvip 31501 Firmware » Version: N/A
cpe:2.3:o:abus:tvip_31501_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Abus » Tvip 31501 » Version: N/A
Abus » Tvip 31550 Firmware » Version: N/A
cpe:2.3:o:abus:tvip_31550_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Abus » Tvip 31550 » Version: N/A
Abus » Tvip 31551 Firmware » Version: N/A
cpe:2.3:o:abus:tvip_31551_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Abus » Tvip 31551 » Version: N/A
Abus » Tvip 32500 Firmware » Version: N/A
cpe:2.3:o:abus:tvip_32500_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Abus » Tvip 32500 » Version: N/A
Abus » Tvip 51500 Firmware » Version: N/A
cpe:2.3:o:abus:tvip_51500_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Abus » Tvip 51500 » Version: N/A
Abus » Tvip 51550 Firmware » Version: N/A
cpe:2.3:o:abus:tvip_51550_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Abus » Tvip 51550 » Version: N/A
Abus » Tvip 71500 Firmware » Version: N/A
cpe:2.3:o:abus:tvip_71500_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Abus » Tvip 71500 » Version: N/A
Abus » Tvip 71501 Firmware » Version: N/A
cpe:2.3:o:abus:tvip_71501_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Abus » Tvip 71501 » Version: N/A
Abus » Tvip 71550 Firmware » Version: N/A
cpe:2.3:o:abus:tvip_71550_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Abus » Tvip 71550 » Version: N/A
Abus » Tvip 71551 Firmware » Version: N/A
cpe:2.3:o:abus:tvip_71551_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Abus » Tvip 71551 » Version: N/A
Abus » Tvip 72500 Firmware » Version: N/A
cpe:2.3:o:abus:tvip_72500_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Abus » Tvip 72500 » Version: N/A

Exploit prediction scoring system (EPSS) score for CVE-2018-17558

EPSS FAQ

0.64%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 79 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2018-17558

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source	First Seen
9.8	CRITICAL	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	3.9	5.9	134c704f-9b21-4f2e-91b3-4a467353bcc0	2024-09-11
Attack Vector: Network Attack Complexity: Low Privileges Required: None User Interaction: None Scope: Unchanged Confidentiality: High Integrity: High Availability: High
9.8	CRITICAL	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	3.9	5.9	NIST	2024-09-11
Attack Vector: Network Attack Complexity: Low Privileges Required: None User Interaction: None Scope: Unchanged Confidentiality: High Integrity: High Availability: High

CWE ids for CVE-2018-17558

CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Assigned by: 134c704f-9b21-4f2e-91b3-4a467353bcc0 (Secondary)
CWE-798 Use of Hard-coded Credentials

The product contains hard-coded credentials, such as a password or cryptographic key.

Assigned by: nvd@nist.gov (Primary)

References for CVE-2018-17558

https://sec.maride.cc/posts/abus/

Five Vulnerabilities in ABUS cameras :: sec.maride.cc
Exploit;Third Party Advisory

CVEs referencing this url
https://www.ccc.de/en/updates/2019/update-nicht-verfugbar-hersteller-nicht-zu-erreichen

CCC | Update nicht verfügbar: Lieferant nicht zu erreichen
Third Party Advisory

CVEs referencing this url

Jump to

Vulnerability Details : CVE-2018-17558

Products affected by CVE-2018-17558

Exploit prediction scoring system (EPSS) score for CVE-2018-17558

CVSS scores for CVE-2018-17558

CWE ids for CVE-2018-17558

References for CVE-2018-17558