Vacron Camera Command Injection Remote Code Execution Vulnerability

A remote code execution vulnerability has been identified in Vacron Camera devices, specifically within the webs.cgi endpoint. This issue arises from improper validation of user-supplied strings, which can be exploited to execute arbitrary code with root privileges. Authentication is required to exploit this vulnerability.

Impact

Exploitation of this vulnerability allows for arbitrary code execution on the affected device, with the executed code running in the context of the root user.

Remediation

The recommended mitigation strategy is to restrict interaction with the affected product.