What’s Vulnerable › Vulnerabilities

CVE-2017-9828

• Severity: critical (CVSS 9.8 v3.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 82.5% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2017-06-23 · updated 2026-06-17
• Weakness: CWE-78

Description

'/cgi-bin/admin/testserver.cgi' of the web service in most of the VIVOTEK Network Cameras is vulnerable to shell command injection, which allows remote attackers to execute any shell command as root via a crafted HTTP request. This vulnerability is already verified on VIVOTEK Network Camera IB8369/FD8164/FD816BA; most others have similar firmware that may be affected. An attack uses shell metacharacters in the senderemail parameter.

Affected products

• Vivotek Network Camera Fd8164 Firmware: fd8164-_vvtk-0200b
• Vivotek Network Camera Fd816Ba Firmware: fd816ba-vvtk-010101.
• Vivotek Network Camera Ib8369 Firmware: ib8369-vvtk-0102a

References

• https://blog.cal1.cn/post/An%20easy%20way%20to%20pwn%20most%20of%20the%20vivotek%20network%20cameras
• https://blog.cal1.cn/post/An%20easy%20way%20to%20pwn%20most%20of%20the%20vivotek%20network%20cameras

Get alerted when CVE-2017-9828 or the next vulnerability affects your stack