CVE-2017-5674

Name of the Vulnerable Software and Affected Versions Foscam, Vstarcam, and multiple white-label IP camera models (affected versions not specified)

Description A vulnerability in a custom-built GoAhead web server allows an attacker to craft a malformed HTTP request, such as "GET system.ini HTTP/1.1

", to disclose the configuration file with the login password.

Recommendations For Foscam, Vstarcam, and multiple white-label IP camera models, consider restricting access to the web server until a fix is available. As a temporary workaround, avoid using the web interface to access configuration files until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.