CVE-2017-17105 is a critical unauthenticated, blind remote command injection vulnerability affecting Zivif PR115-204-P-RS web cameras running firmware versions V2.3.4.2103 and V4.7.4.2121. This flaw allows an attacker to execute arbitrary commands on the device through vulnerable CGI scripts in the web interface, as demonstrated by a crafted request to iptest.cgi. With a CVSS score of 9.8 (CRITICAL), the vulnerability is easily exploitable over the network without authentication and can lead to complete compromise of the device, including confidentiality, integrity, and availability. While not listed on CISA's KEV catalog, exploit modules are publicly available in Metasploit, and the vulnerability has been linked to the Zerobot IoT botnet in media coverage, indicating active exploitation and significant community attention.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
2.3.4.2103CPE matchmatch criteria | cpe:2.3:o:zivif:pr115-204-p-rs_firmware:2.3.4.2103:*:*:*:*:*:*:* | ||
4.7.4.2121CPE matchmatch criteria | cpe:2.3:o:zivif:pr115-204-p-rs_firmware:4.7.4.2121:*:*:*:*:*:*:* |
CVSS version used by this source: 3.0
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.3 Bluesky, 0.3 Mastodon, and 2.4 GitHub mentions.
The average CVE in this peer group has 0.3 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
Remediation records are not available for this CVE.