CVE-2020-7879: ipTIME C200 IP Camera command injection vulnerability

Severity: critical (CVSS 9.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2021-11-30 · updated 2026-06-17
Weakness: CWE-78

Description

This issue was discovered when the ipTIME C200 IP Camera was synchronized with the ipTIME NAS. It is necessary to extract value for ipTIME IP camera because the ipTIME NAS send ans setCookie('[COOKIE]') . The value is transferred to the --header option in wget binary, and there is no validation check. This vulnerability allows remote attackers to execute remote command.

Affected products

EFM networks & multimedia ipTIME C200 IP Camera: through 1.0.16

References

https://www.boho.or.kr/krcert/secNoticeView.do?bulletin_writing_sequence=36365
https://www.boho.or.kr/krcert/secNoticeView.do?bulletin_writing_sequence=36365

Get alerted when CVE-2020-7879 or the next vulnerability affects your stack