CVE-2017-5674

A vulnerability in a custom-built GoAhead web server used on Foscam, Vstarcam, and multiple white-label IP camera models allows an attacker to craft a malformed HTTP ("GET system.ini HTTP/1.1\n\n" - note the lack of "/" in the path field of the request) request that will disclose the configuration file with the login password.

CVSS 3.0

9.8CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS

22% chance of exploitation in the next 30 days; higher than 97% of CVEs (scores of 2026-10-25)

CWE

CWE-200

Published

2017-03-13

Modified

2026-10-15

Record from

the NVD, synced 2026-10-19

Affected

• embedthis:goahead

References

• https://www.cybereason.com/cve-ip-cameras/
• https://www.cybereason.com/zero-day-exploits-turn-hundreds-of-thousands-of-ip-cameras-into-iot-botnet-slaves/
• https://www.cybereason.com/cve-ip-cameras/
• https://www.cybereason.com/zero-day-exploits-turn-hundreds-of-thousands-of-ip-cameras-into-iot-botnet-slaves/

Check your stackJSON