CVE-2005-0478: TrackerCam buffer overflows via User-Agent header and PHP script arguments

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: medium.

high priorityThe vulnerability is remotely exploitable without authentication, has public exploit references, and a very high EPSS score, though the CVSS impact is limited to partial availability loss.

What it is

TrackerCam 5.12 and earlier contain multiple buffer overflows reachable through HTTP requests, specifically a long User-Agent header and a long argument passed to an arbitrary PHP script. Successful exploitation can crash the service and may allow arbitrary code execution on the host.

Impact

An attacker can cause a denial of service and potentially execute arbitrary code with the privileges of the web service. This could lead to full compromise of the affected system.

Attack surface

The flaws are reachable over the network via HTTP requests to the TrackerCam web interface. No authentication or user interaction is required, as indicated by the CVSS vector AV:N/AC:L/Au:N.

Exploitation

Public exploit references are tagged Exploit and Vendor Advisory, and EPSS estimates a 66.5% probability of exploitation within 30 days (99.2nd percentile). The CVE is not listed in CISA KEV, so no confirmed in-the-wild activity is recorded.

What to do

• Apply the vendor patch or upgrade TrackerCam beyond version 5.12 if an update is available.
• If no patch exists, isolate the TrackerCam service behind a reverse proxy or firewall that restricts access to trusted networks.
• Disable or remove unnecessary PHP scripts and limit the web server's exposure to the internet.
• Deploy a web application firewall or input filtering to reject overly long User-Agent headers and script arguments.
• Monitor vendor advisories for a fixed release and plan decommissioning of unsupported versions.

Detection

• Inspect web server and application logs for HTTP requests with abnormally long User-Agent headers.
• Monitor for requests to PHP scripts with unusually long or malformed query string arguments.
• Watch for repeated crashes or restarts of the TrackerCam service, which may indicate exploitation attempts.
• Use network monitoring to detect anomalous HTTP traffic patterns targeting the TrackerCam interface.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.