Vulnerability record · CVE-2017-9829 · published 23 June 2017
CVE-2017-9829: VIVOTEK Network Cameras path traversal in downloadMedias.cgi
Vivotek · Network Camera Ib8369 Firmware
The downloadMedias.cgi endpoint in the web service of most VIVOTEK Network Cameras fails to sanitize ".." sequences in HTTP requests, allowing directory traversal. An unauthenticated remote attacker can read arbitrary files from the camera's Linux filesystem, which matters because these devices often store credentials and configuration data.
Description
'/cgi-bin/admin/downloadMedias.cgi' of the web service in most of the VIVOTEK Network Cameras is vulnerable, which allows remote attackers to read any file on the camera's Linux filesystem via a crafted HTTP request containing ".." sequences. This vulnerability is already verified on VIVOTEK Network Camera IB8369/FD8164/FD816BA; most others have similar firmware that may be affected.
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Automated analysis
high priorityUnauthenticated remote file read with a very high EPSS score and no known patch detail in the record, though not observed in KEV or ransomware campaigns.
What it is
The downloadMedias.cgi endpoint in the web service of most VIVOTEK Network Cameras fails to sanitize ".." sequences in HTTP requests, allowing directory traversal. An unauthenticated remote attacker can read arbitrary files from the camera's Linux filesystem, which matters because these devices often store credentials and configuration data.
Impact
An attacker gains read access to any file on the camera filesystem, including configuration and credential files, which can enable further compromise of the device or network.
Attack surface
Reachable over the network via HTTP requests to /cgi-bin/admin/downloadMedias.cgi; the CVSS vector shows no privileges or user interaction required.
Exploitation
Not listed in CISA KEV and no ransomware associations, but EPSS is very high at 0.687 (99.3rd percentile) and a public third-party advisory describes the technique, indicating elevated likelihood of exploitation.
What to do
- Apply the latest VIVOTEK firmware for affected camera models; if no fix exists, isolate or replace the device.
- Block or restrict external and untrusted network access to camera web interfaces and the /cgi-bin/admin/ path.
- Place cameras on a segmented VLAN with strict firewall rules limiting access to trusted management hosts only.
- Disable or restrict the web management service where not required, and change default credentials.
- Monitor vendor advisories for updated firmware covering additional affected models.
Detection
- Inspect HTTP request logs for ".." or encoded traversal sequences targeting /cgi-bin/admin/downloadMedias.cgi.
- Alert on requests to downloadMedias.cgi from unexpected or external source IPs.
- Monitor camera outbound connections and file access anomalies that could indicate post-exploitation activity.
- Use network IDS signatures for path traversal patterns against VIVOTEK camera endpoints.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Affected products
3 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
| Link | Tags |
|---|---|
| https://blog.cal1.cn/post/An%20easy%20way%20to%20pwn%20most%20of%20the%20vivotek%20network%20cameras | Third Party Advisory |
| https://blog.cal1.cn/post/An%20easy%20way%20to%20pwn%20most%20of%20the%20vivotek%20network%20cameras | Third Party Advisory |
Track CVE-2017-9829 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2017-9829), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.
