Martin Dessauer

The issue allows authenticated remote code execution due to the unarchive programs (7za and unrar) preserving executable file permissions. An attacker with Control capability can execute a file by setting the value of `SevenZipCommand` or `UnrarCmd`. This issue only affects products that are no longer supported by the maintainer.

An issue was discovered on certain ABUS TVIP devices due to a path traversal in the `/opt/cgi/admin/filewrite` API endpoint. This allows an attacker to write to files and thus execute code arbitrarily with root privileges.

Hardcoded manufacturer credentials and an OS command injection vulnerability in the "/cgi-bin/mft/" directory allow remote attackers to execute code as root.

The issue is related to incorrect access control, allowing unauthenticated remote attackers to view the "/video.mjpg" video stream.

The issue allows attackers to gain control of the program via a crafted string sent to the `sprintf()` function. This is a Buffer Overflow vulnerability in certain ABUS TVIP cameras.

An issue was discovered in certain ABUS TVIP cameras, where the CGI scripts allow remote attackers to execute code via `system()` as root. There are several injection points in various scripts.