CVE Feed

    Dashboard / CVE / CVE-2017-9833

    CVE-2017-9833

    /cgi-bin/wapopen in Boa 0.94.14rc21 allows the injection of "../.." using the FILECAMERA variable (sent by GET) to read files with root privileges. NOTE: multiple third parties report that this is a system-integrator issue (e.g., a vulnerability on one type of camera) because Boa does not include any wapopen program or any code to read a FILECAMERA variable.

    Published:Jun 24, 2017
    Last Modified:Apr 20, 2025
    EPS:Jun 24, 2017
    EPSS Score:0.90748
    CVSS Score:7.5

    Affected Products

    Vendor
    Boa
    Product
    Boa

    Exploits

    https://pastebin.com/raw/rt7LJvyFhttps://www.exploit-db.com/exploits/42290/https://pastebin.com/raw/rt7LJvyFhttps://www.exploit-db.com/exploits/42290/https://www.exploit-db.com/exploits/42290https://github.com/anldori/CVE-2017-9833

    Related CVEs

    CVE-2025-56498 (CVSS 5.3) — An OS command injection vulnerability exists in PLDT WiFi Router's Prolink PGN6401V Firmware 8.1.2 web managem…
    CVE-2024-43367 (CVSS 7.5) — Boa is an embeddable and experimental Javascript engine written in Rust. Starting in version 0.16 and prior to…
    CVE-2022-45956 (CVSS 5.3) — Boa Web Server versions 0.94.13 through 0.94.14 fail to validate the correct security constraint on the HEAD H…
    CVE-2022-44117 (CVSS 9.8) — Boa 0.94.14rc21 is vulnerable to SQL Injection via username. NOTE: the is disputed by multiple third parties b…
    CVE-2021-33558 (CVSS 7.5) — Boa 0.94.13 allows remote attackers to obtain sensitive information via a misconfiguration involving backup.ht…
    CVE-2018-21028 (CVSS 7.5) — Boa through 0.94.14rc21 allows remote attackers to trigger a memory leak because of missing calls to the free …
    CVE-2018-21027 (CVSS 9.8) — Boa through 0.94.14rc21 allows remote attackers to trigger an out-of-memory (OOM) condition because malloc is …
    CVE-2016-9564 (CVSS 7.5) — Buffer overflow in send_redirect() in Boa Webserver 0.92r allows remote attackers to DoS via an HTTP GET reque…
    CVE-2009-4496 (CVSS 5) — Boa 0.94.14rc21 writes data to a log file without sanitizing non-printable characters, which might allow remot…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High