CVE-2013-2568: Zavio IP Cameras command injection in wireless_mft.cgi ap parameter

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 20 September 2026. Confidence: high.

critical priorityUnauthenticated remote command execution with CVSS 9.8 and high EPSS on internet-exposed IoT devices makes this an urgent fix despite the absence of KEV listing.

What it is

Zavio IP Cameras through firmware 1.6.3 pass the ap parameter of /cgi-bin/mft/wireless_mft.cgi to a shell without sanitization, allowing OS command injection. The flaw is remotely reachable and unauthenticated per the CVSS vector, so any exposed camera can be turned into an execution point on the local network.

Impact

An attacker can execute arbitrary commands on the camera with the privileges of the CGI process, gaining full control of the device and a foothold for lateral movement into the camera's network segment.

Attack surface

Reached over the network via an HTTP request to /cgi-bin/mft/wireless_mft.cgi with a crafted ap parameter; the CVSS vector indicates no authentication and no user interaction are required.

Exploitation

Not listed in CISA KEV and no ransomware association is recorded, but EPSS is 0.485 (98.8th percentile) and a Core Security advisory is tagged Exploit, indicating public exploit material exists.

What to do

• Upgrade Zavio camera firmware beyond 1.6.3 if a fixed release is available; the record does not name a patched version, so confirm with the vendor.
• If no fix exists, isolate cameras on a dedicated VLAN with no route to management or user networks.
• Block or restrict external and cross-segment access to /cgi-bin/mft/wireless_mft.cgi and the camera web interface.
• Disable or replace end-of-life Zavio F3105/F312A units that cannot be patched.
• Change default credentials and disable unused services such as UPnP and remote access.

Detection

• Monitor HTTP request logs and IDS/IPS for requests to /cgi-bin/mft/wireless_mft.cgi with shell metacharacters in the ap parameter.
• Alert on unexpected outbound connections or new processes spawned by the camera's CGI/web service.
• Baseline camera traffic and flag anomalous DNS, HTTP or reverse-shell patterns originating from camera IPs.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.