CVE-2017-17105: Zivif web cameras unauthenticated OS command injection via CGI

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: high.

critical priorityCVSS 9.8 with no authentication or user interaction required, public exploit references, and a very high EPSS probability make this an urgent exposure for any Internet-reachable Zivif camera.

What it is

Zivif PR115-204-P-RS web cameras (V2.3.4.2103 and V4.7.4.2121, possibly versions in between) pass user-supplied input from CGI scripts in the web interface into OS commands without sanitisation. An unauthenticated attacker can inject arbitrary commands through a crafted request to cgi-bin/iptest.cgi, giving full control of the device. The flaw is a classic CWE-78 command injection with a critical CVSS score of 9.8.

Impact

An attacker gains remote code execution on the camera with the privileges of the web service, allowing device takeover, data theft, and use of the camera as a foothold into the network. Because the injection is blind, effects such as a reboot are observed indirectly.

Attack surface

Reachable over the network through the camera's HTTP web interface, specifically the cgi-bin/iptest.cgi endpoint. No authentication or user interaction is required per the CVSS vector (AV:N/AC:L/PR:N/UI:N).

Exploitation

Public exploit code and a full-disclosure write-up are referenced, and EPSS is 0.84558 (99.69th percentile), indicating a high likelihood of exploitation. The CVE is not listed in CISA KEV, so no confirmed in-the-wild activity is recorded here.

What to do

• Apply the vendor firmware update for the affected Zivif PR115-204-P-RS models; if no fixed firmware exists, isolate or replace the devices.
• Block or restrict access to the camera web interface and cgi-bin endpoints from untrusted networks using firewall rules or a management VLAN.
• Disable remote/Internet exposure of the cameras and require access through a VPN or authenticated reverse proxy.
• Monitor vendor advisories for updated firmware, since the record does not name a patched version.
• If the device cannot be secured, power it down or remove it from the network.

Detection

• Inspect HTTP access logs for requests to cgi-bin/iptest.cgi, especially with cmd, -time, or -url parameters containing shell metacharacters such as $(), backticks, ;, |, or &&.
• Alert on unexpected device reboots or process restarts that correlate with inbound HTTP requests to the camera.
• Monitor outbound connections from camera IPs to unusual destinations, which may indicate command-and-control or lateral movement.
• Use network monitoring to flag unauthenticated access to camera management interfaces from outside expected management subnets.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.