ipTIME C200 IP Camera command injection vulnerability
Priority MEDIUM 45CWE-78Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Code execution
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-78.
Summary
This issue was discovered when the ipTIME C200 IP Camera was synchronized with the ipTIME NAS. It is necessary to extract value for ipTIME IP camera because the ipTIME NAS send ans setCookie('[COOKIE]') . The value is transferred to the --header option in wget binary, and there is no validation check. This vulnerability allows remote attackers to execute remote command.
Why it matters now
EPSS 0.01448 73rd percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| EFM | ipTIME C200 IP Camera | 1.0.16 – 1.0.16 | — | No fix listed | CNA |
- ipTIME C200 IP Camera VendorEFM Affected 1.0.16 – 1.0.16 Fixed in — No fix listed CNA
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2020-7879
- 2026-10-03 Alias added: GHSA-54vf-jrm9-p98w
References
More EFM C200 Firmware vulnerabilities
- TI-2021-08332 IpTime C200 IP camera remote code execution vulnerability CVSS 3.1CRITICAL 9.8
- TI-2020-06356 Improper input validation in EFM ipTIME C200 IP Camera CVSS 3.1HIGH 8.0
Sources
- CVE-2020-7879 · CVE Program
- CVE-2020-7879 · NVD
- FIRST EPSS
- GHSA-54vf-jrm9-p98w · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences