CVE-2023-38025: SpotCam Co., Ltd. SpotCamFHD - Command Injection -1

Severity: critical (CVSS 9.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.6% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2023-08-28 · updated 2026-06-17
Weakness: CWE-78

Description

SpotCam Co., Ltd. SpotCam FHD 2’s hidden Telnet function has a vulnerability of OS command injection. An remote unauthenticated attacker can exploit this vulnerability to execute command injection attack to arbitrary system commands or disrupt service.

Affected products

SPOTCAM CO., LTD. SpotCam FHD 2: before 1.0039 — fixed in 1.0039

How to fix

Upgrade to a fixed version: SPOTCAM CO., LTD. SpotCam FHD 2 1.0039. Check the vendor advisory for mitigations.

References

https://www.twcert.org.tw/tw/cp-132-7332-ee011-1.html
https://www.twcert.org.tw/tw/cp-132-7332-ee011-1.html

Get alerted when CVE-2023-38025 or the next vulnerability affects your stack