CVE-2014-1902
Description
Multiple cross-site scripting (XSS) vulnerabilities in Y-Cam camera models SD range YCB003, YCK003, and YCW003; S range YCB004, YCK004, YCW004; EyeBall YCEB03; Bullet VGA YCBL03 and YCBLB3; Bullet HD 720 YCBLHD5; Y-cam Classic Range YCB002, YCK002, and YCW003; and Y-cam Original Range YCB001, YCW001, running firmware 4.30 and earlier, allow remote authenticated users to inject arbitrary web script or HTML via the (1) SYSCONTACT parameter to form/identityApply, as triggered using en/identity.asp; (2) PASSWD parameter to form/accAdd, as triggered using en/account/accedit.asp; (3) NTPSERVER parameter to form/clockApply, as triggered using en/clock.asp; (4) SERVER parameter to form/smtpclientApply, as triggered using en/smtpclient.asp; (5) SERVER parameter to form/ftpApply, as triggered using en/ftp.asp; or (6) SERVER parameter to form/httpEventApply, as triggered using en/httpevent.asp.
How to fix
Sources list no fixed version or patch link for this vulnerability.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| y-cam ycb004_firmware | 4.30 | — |
| y-cam ycb002_firmware | 4.30 | — |
| y-cam yck002_firmware | 4.30 | — |
| y-cam yck003_firmware | 4.30 | — |
| y-cam yceb03_firmware | 4.30 | — |
| y-cam ycb001_firmware | 4.30 | — |
| y-cam ycblhd5_firmware | 4.30 | — |
| y-cam ycblb3_firmware | 4.30 | — |
| y-cam ycblb3 | No range specified | — |
| y-cam ycb003_firmware | 4.30 | — |
| y-cam ycw003_firmware | 4.30 | — |
| y-cam ycw004_firmware | 4.30 | — |
| y-cam ycw004 | No range specified | — |
| y-cam ycbl03_firmware | 4.30 | — |
| y-cam ycbl03 | No range specified | — |
| y-cam yck004_firmware | 4.30 | — |
| y-cam ycw001_firmware | 4.30 | — |
| y-cam ycw002_firmware | 4.30 | — |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.