Zavio f3105 Firmware vulnerabilities

4 CVEs affecting Zavio f3105 Firmware, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2013-2570, published 2020-01-29.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2013-2568, published 2020-01-29. Critical severity, CVSS 9.8. EPSS: 48.5% chance of exploitation in the next 30 days. A Command Injection vulnerability exists in Zavio IP Cameras through 1.6.3 via the ap parameter to /cgi-bin/mft/wireless_mft.cgi, which could let a remote malicious user execute arbitrary code.
CVE-2013-2569, published 2020-01-29. High severity, CVSS 7.5. EPSS: 31% chance of exploitation in the next 30 days. A Security Bypass vulnerability exists in Zavio IP Cameras through 1.6.3 because the RTSP protocol authentication is disabled by default, which could let a malicious user obtain unauthorized access…
CVE-2013-2570, published 2020-01-29. Critical severity, CVSS 9.8. EPSS: 26.6% chance of exploitation in the next 30 days. A Command Injection vulnerability exists in Zavio IP Cameras through 1.6.3 in the General.Time.NTP.Server parameter to the sub_C8C8 function of the binary /opt/cgi/view/param, which could let a…
CVE-2013-2567, published 2020-01-29. High severity, CVSS 7.5. EPSS: 14.6% chance of exploitation in the next 30 days. An Authentication Bypass vulnerability exists in the web interface in Zavio IP Cameras through 1.6.03 due to a hardcoded admin account found in boa.conf, which lets a remote malicious user obtain…