CVE-2023-38025 - Vulnerability Details - OpenCVE

SpotCam Co., Ltd. SpotCam FHD 2’s hidden Telnet function has a vulnerability of OS command injection. An remote unauthenticated attacker can exploit this vulnerability to execute command injection attack to arbitrary system commands or disrupt service.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.01661.

Exploitation none

Automatable yes

Technical Impact total

Vendors	Products
Myspotcam	Fhd 2 Fhd 2 Firmware
Spotcam Co Ltd	Spotcam Fhd2

Configuration 1 [-]

AND

cpe:2.3:o:myspotcam:fhd_2_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:myspotcam:fhd_2:-:*:*:*:*:*:*:*

No data.

No data.

Advisories

Source	ID	Title
EUVD	EUVD-2023-41852	SpotCam Co., Ltd. SpotCam FHD 2’s hidden Telnet function has a vulnerability of OS command injection. An remote unauthenticated attacker can exploit this vulnerability to execute command injection attack to arbitrary system commands or disrupt service.

Fixes

Solution

Update firmware version to 1.0039 or later.

Workaround

No workaround given by the vendor.

References

Link	Providers
https://www.twcert.org.tw/tw/cp-132-7332-ee011-1.html

History

Wed, 02 Oct 2024 15:30:00 +0000

Type	Values Removed	Values Added
First Time appeared		Spotcam Co Ltd Spotcam Co Ltd spotcam Fhd2
CPEs		cpe:2.3:a:spotcam_co_ltd:spotcam_fhd2::::::::
Vendors & Products		Spotcam Co Ltd Spotcam Co Ltd spotcam Fhd2
Metrics		ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

MITRE

Status: PUBLISHED

Assigner: twcert

Published: 2023-08-28T03:21:04.106Z

Updated: 2024-10-02T15:00:17.631Z

Reserved: 2023-07-12T00:37:03.716Z

Link: CVE-2023-38025

Vulnrichment

Updated: 2024-08-02T17:23:27.924Z

NVD

Status : Modified

Published: 2023-08-28T04:15:16.477

Modified: 2024-11-21T08:12:41.877

Link: CVE-2023-38025

Redhat

No data.

OpenCVE Enrichment

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2023-38025", "assignerOrgId": "cded6c7f-6ce5-4948-8f87-aa7a3bbb6b0e", "state": "PUBLISHED", "assignerShortName": "twcert", "dateReserved": "2023-07-12T00:37:03.716Z", "datePublished": "2023-08-28T03:21:04.106Z", "dateUpdated": "2024-10-02T15:00:17.631Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "SpotCam FHD 2", "vendor": "SPOTCAM CO., LTD.", "versions": [{"status": "affected", "version": "1.0036"}]}], "datePublic": "2023-08-31T01:00:00.000Z", "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "\n\n<span style=\"background-color: rgb(255, 255, 255);\">SpotCam Co., Ltd. SpotCam FHD 2\u2019s hidden Telnet function has a vulnerability of OS command injection. An remote unauthenticated attacker can exploit this vulnerability to execute command injection attack to arbitrary system commands or disrupt service.</span>\n\n"}], "value": "\nSpotCam Co., Ltd. SpotCam FHD 2\u2019s hidden Telnet function has a vulnerability of OS command injection. An remote unauthenticated attacker can exploit this vulnerability to execute command injection attack to arbitrary system commands or disrupt service.\n\n"}], "impacts": [{"capecId": "CAPEC-88", "descriptions": [{"lang": "en", "value": "CAPEC-88 OS Command Injection"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"description": "CWE 78 OS Command Injection", "lang": "en"}]}], "providerMetadata": {"orgId": "cded6c7f-6ce5-4948-8f87-aa7a3bbb6b0e", "shortName": "twcert", "dateUpdated": "2023-08-28T03:21:04.106Z"}, "references": [{"url": "https://www.twcert.org.tw/tw/cp-132-7332-ee011-1.html"}], "solutions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "\n\nUpdate firmware version to 1.0039 or later. \n\n<br>"}], "value": "\nUpdate firmware version to 1.0039 or later. \n\n\n"}], "source": {"advisory": "TVN-202308005", "discovery": "EXTERNAL"}, "title": "SpotCam Co., Ltd. SpotCamFHD - Command Injection -1", "x_generator": {"engine": "Vulnogram 0.1.0-dev"}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T17:23:27.924Z"}, "title": "CVE Program Container", "references": [{"url": "https://www.twcert.org.tw/tw/cp-132-7332-ee011-1.html", "tags": ["x_transferred"]}]}, {"affected": [{"vendor": "spotcam_co_ltd", "product": "spotcam_fhd2", "cpes": ["cpe:2.3:a:spotcam_co_ltd:spotcam_fhd2:*:*:*:*:*:*:*:*"], "defaultStatus": "unaffected", "versions": [{"version": "1.0036", "status": "affected"}]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2024-10-02T14:59:42.269526Z", "id": "CVE-2023-38025", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-10-02T15:00:17.631Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://www.twcert.org.tw/tw/cp-132-7332-ee011-1.html", "tags": ["x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T17:23:27.924Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2023-38025", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2024-10-02T14:59:42.269526Z"}}}], "affected": [{"cpes": ["cpe:2.3:a:spotcam_co_ltd:spotcam_fhd2:*:*:*:*:*:*:*:*"], "vendor": "spotcam_co_ltd", "product": "spotcam_fhd2", "versions": [{"status": "affected", "version": "1.0036"}], "defaultStatus": "unaffected"}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-10-02T15:00:11.792Z"}}], "cna": {"title": "SpotCam Co., Ltd. SpotCamFHD - Command Injection -1", "source": {"advisory": "TVN-202308005", "discovery": "EXTERNAL"}, "impacts": [{"capecId": "CAPEC-88", "descriptions": [{"lang": "en", "value": "CAPEC-88 OS Command Injection"}]}], "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "SPOTCAM CO., LTD.", "product": "SpotCam FHD 2", "versions": [{"status": "affected", "version": "1.0036"}], "defaultStatus": "unaffected"}], "solutions": [{"lang": "en", "value": "\nUpdate firmware version to 1.0039 or later. \n\n\n", "supportingMedia": [{"type": "text/html", "value": "\n\nUpdate firmware version to 1.0039 or later. \n\n<br>", "base64": false}]}], "datePublic": "2023-08-31T01:00:00.000Z", "references": [{"url": "https://www.twcert.org.tw/tw/cp-132-7332-ee011-1.html"}], "x_generator": {"engine": "Vulnogram 0.1.0-dev"}, "descriptions": [{"lang": "en", "value": "\nSpotCam Co., Ltd. SpotCam FHD 2\u2019s hidden Telnet function has a vulnerability of OS command injection. An remote unauthenticated attacker can exploit this vulnerability to execute command injection attack to arbitrary system commands or disrupt service.\n\n", "supportingMedia": [{"type": "text/html", "value": "\n\n<span style=\"background-color: rgb(255, 255, 255);\">SpotCam Co., Ltd. SpotCam FHD 2\u2019s hidden Telnet function has a vulnerability of OS command injection. An remote unauthenticated attacker can exploit this vulnerability to execute command injection attack to arbitrary system commands or disrupt service.</span>\n\n", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE 78 OS Command Injection"}]}], "providerMetadata": {"orgId": "cded6c7f-6ce5-4948-8f87-aa7a3bbb6b0e", "shortName": "twcert", "dateUpdated": "2023-08-28T03:21:04.106Z"}}}, "cveMetadata": {"cveId": "CVE-2023-38025", "state": "PUBLISHED", "dateUpdated": "2024-10-02T15:00:17.631Z", "dateReserved": "2023-07-12T00:37:03.716Z", "assignerOrgId": "cded6c7f-6ce5-4948-8f87-aa7a3bbb6b0e", "datePublished": "2023-08-28T03:21:04.106Z", "assignerShortName": "twcert"}, "dataVersion": "5.1"}