CVE-2010-2309: EvoCam web server buffer overflow via long GET request

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 20 September 2026. Confidence: medium.

high priorityRemote, unauthenticated code execution with a public exploit and very high EPSS, but the product is niche and no KEV listing or confirmed active exploitation is recorded.

What it is

EvoLogical EvoCam 3.6.6 and 3.6.7 contain a buffer overflow in their built-in web server, triggered by an overly long GET request. A remote, unauthenticated attacker can crash the service or potentially execute arbitrary code on the host running the camera software.

Impact

Successful exploitation gives the attacker code execution in the context of the EvoCam web server process, or at minimum a denial of service. Because the software runs on a user's machine, this can lead to full compromise of that host.

Attack surface

Reachable over the network through the EvoCam HTTP web server; the CVSS vector AV:N/AC:L/Au:N indicates no authentication and no user interaction are required. Any host that can reach the listening web port can send the malicious GET request.

Exploitation

A public exploit exists (Exploit-DB 13735) and EPSS is high at roughly 0.51 (98.9th percentile), though the CVE is not listed in CISA KEV. No confirmed in-the-wild exploitation is documented in this record.

What to do

• Upgrade EvoCam past 3.6.7 or apply the vendor fix referenced in Secunia advisory 39988; if no fixed version exists, retire or replace the product.
• Do not expose the EvoCam web server to untrusted networks; restrict access to a management VLAN or localhost only.
• Place the service behind a reverse proxy or firewall rule that caps request-line and header length and blocks oversized GET requests.
• Run the EvoCam service under a low-privilege account to limit the impact of code execution.

Detection

• Alert on HTTP request lines or headers exceeding normal length to the EvoCam port, especially GET requests with very long URIs.
• Monitor for crashes or restarts of the EvoCam web server process, which may indicate a failed overflow attempt.
• Watch for unexpected child processes or outbound connections originating from the EvoCam process, a sign of successful code execution.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.