A vulnerability in a custom-built GoAhead web server used on Foscam, Vstarcam, and multiple white-label IP camera models allows an attacker to craft a malformed HTTP ("GET system.ini HTTP/1.1\n\n" - note the lack of "/" in the path field of the request) request that will disclose the configuration file with the login password.
Fix
Nothing published yet: no patch, vendor advisory or mitigation reference on NVD, no vendor advisory in the News for this CVE, not in CISA's KEV, no fixed package version. BaselineWatch does not guess at one.
Change history 1
- First seenCVSS 9.8 · embedthisNVD modified 2026-10-15 16:17
Affected (CPE criteria) 1
cpe:2.3:a:embedthis:goahead:-:*:*:*:*:*:*:*
References 4
- https://www.cybereason.com/cve-ip-cameras/ Exploit, Third Party Advisory
- https://www.cybereason.com/zero-day-exploits-turn-hundreds-of-thousands-of-ip-cameras-into-iot-botnet-slaves/ Exploit, Technical Description, Third Party Advisory
- https://www.cybereason.com/cve-ip-cameras/ Exploit, Third Party Advisory
- https://www.cybereason.com/zero-day-exploits-turn-hundreds-of-thousands-of-ip-cameras-into-iot-botnet-slaves/ Exploit, Technical Description, Third Party Advisory