EFM ipTIME C200 Command Injection Vulnerability in ApplyRestore Endpoint

A command injection vulnerability has been identified in the EFM ipTIME C200 IP camera, affecting firmware versions through 1.092. The issue arises in the ApplyRestore endpoint within the 'iux_set.cgi' file, specifically in the 'sub_408F90' function. This vulnerability allows remote attackers to inject shell commands into certain configuration fields of a backup file, which are then executed with root privileges on the device.

Impact

Exploitation of this vulnerability allows for arbitrary command execution with root privileges on the affected device.

Reproduction

To reproduce this vulnerability, first obtain a valid session by logging into the device. After logging in, upload a malicious configuration file through the ApplyRestore endpoint that includes injected commands in the 'sysset_userid' or 'sysset_userpw' fields. Once the file is processed, the injected commands will be executed with root privileges.