CVE-2017-9828

CRITICAL

'/cgi-bin/admin/testserver.cgi' of the web service in most of the VIVOTEK Network Cameras is vulnerable to shell command injection, which allows remote attackers to execute any shell command as root via a crafted HTTP request. This vulnerability is already verified on VIVOTEK Network Camera IB8369/FD8164/FD816BA; most others have similar firmware that may be affected. An attack uses shell metacharacters in the senderemail parameter.

Published: Jun 23, 2017 Modified: Jun 17, 2026

CWE-78

CVSS Metrics

CVSSv3

Attack Vector: NETWORK Attack Complexity: LOW Privileges Required: NONE User Interaction: NONE Scope: UNCHANGED Confidentiality Impact: HIGH Integrity Impact: HIGH Availability Impact: HIGH

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected Products (3)

Vendor	Product	Version
vivotek	network_camera_ib8369_firmware	ib8369-vvtk-0102a
vivotek	network_camera_fd8164_firmware	fd8164-_vvtk-0200b
vivotek	network_camera_fd816ba_firmware	fd816ba-vvtk-010101.

GitHub Security Advisory GHSA-mcp7-747p-3h68

'/cgi-bin/admin/testserver.cgi' of the web service in most of the VIVOTEK Network Cameras is...

References (2)

https://blog.cal1.cn/post/An%20easy%20way%20to%20pwn%20most%20of%20the%20vivotek%20network%20cameras Third Party Advisory
https://blog.cal1.cn/post/An%20easy%20way%20to%20pwn%20most%20of%20the%20vivotek%20network%20cameras Third Party Advisory

Risk Scores

CVSS Score 9.8 / 10

EPSS Score 82.46%

Top 0% most likely to be exploited

Threat Score 73.9 / 100

Data Sources

NVD EPSS GitHub