CVE-2018-3937
An exploitable command injection vulnerability exists in the measurementBitrateExec functionality of Sony IPELA E Series Network Camera G5 firmware 1.87.00. A specially crafted GET request can cause arbitrary commands to be executed. An attacker can send an HTTP request to trigger this vulnerability.
- Score
- CVSS 3.0 9.1 Critical
- Status
- Modified - talos-cna@cisco.com
- Published
- 2018-08-14
- Last modified
- 2024-09-16
- Weaknesses
- CWE-78
Affected products
- Snc-eb600 Firmware (Sony)
- Snc-eb600b Firmware (Sony)
- Snc-eb602r Firmware (Sony)
- Snc-eb630 Firmware (Sony)
- Snc-eb630b Firmware (Sony)
- Snc-eb632r Firmware (Sony)
- Snc-em600 Firmware (Sony)
- Snc-em601 Firmware (Sony)
- Snc-em602r Firmware (Sony)
- Snc-em602rc Firmware (Sony)
- Snc-em630 Firmware (Sony)
- Snc-em631 Firmware (Sony)
- Snc-em632r Firmware (Sony)
- Snc-em632rc Firmware (Sony)
- Sony (Talos)
References
- https://www.talosintelligence.com/vulnerability_reports/TALOS-2018-0604
