CVE-2017-16566

Published: Nov 17, 2017Modified: May 13, 2026

9.8

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Exploitability: 3.9 / Impact: 5.9

Source: NVD

Description

On Jooan IP Camera A5 2.3.36 devices, an insecure FTP server does not require authentication, which allows remote attackers to read or replace core system files including those used for authentication (such as passwd and shadow). This can be abused to take full root level control of the device.

Affected (1)

Products: Qacctv: Jooan A5 Ip Camera Firmware

1 product

Jooan A5 Ip Camera Firmware

Configuration A

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Qacctv Jooan A5 Ip Camera Firmware	Version 2.3.36

Running on/with	Platform Versions
Qacctv Jooan A5 Ip Camera	All versions

Related CWEs

Improper Authentication

When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.

References (2)

https://siggyd.github.io/Advisories/CVE-2017-16566

Source: cve@mitre.org

Issue TrackingThird Party Advisory

https://siggyd.github.io/Advisories/CVE-2017-16566

Source: af854a3a-2127-422b-91ae-364da2661108

Issue TrackingThird Party Advisory

Timeline

No history available yet.