Alexander Karl

An issue was discovered on certain ABUS TVIP devices due to a path traversal in the `/opt/cgi/admin/filewrite` API endpoint. This allows an attacker to write to files and thus execute code arbitrarily with root privileges.

Hardcoded manufacturer credentials and an OS command injection vulnerability in the "/cgi-bin/mft/" directory allow remote attackers to execute code as root.

The issue is related to incorrect access control, allowing unauthenticated remote attackers to view the "/video.mjpg" video stream.

The issue allows attackers to gain control of the program via a crafted string sent to the `sprintf()` function. This is a Buffer Overflow vulnerability in certain ABUS TVIP cameras.

An issue was discovered in certain ABUS TVIP cameras, where the CGI scripts allow remote attackers to execute code via `system()` as root. There are several injection points in various scripts.