CVE-2018-17558
Hardcoded manufacturer credentials and an OS command injection vulnerability in the /cgi-bin/mft/...
Hardcoded manufacturer credentials and an OS command injection vulnerability in the /cgi-bin/mft/ directory on ABUS TVIP TVIP20050 LM.1.6.18, TVIP10051 LM.1.6.18, TVIP11050 MG.1.6.03.05, TVIP20550 LM.1.6.18, TVIP10050 LM.1.6.18, TVIP11550 MG.1.6.03, TVIP21050 MG.1.6.03, and TVIP51550 MG.1.6.03 cameras allow remote attackers to execute code as root.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
Hardcoded manufacturer credentials and an OS command injection vulnerability in the /cgi-bin/mft/ directory on ABUS TVIP TVIP20050 LM.1.6.18, TVIP10051 LM.1.6.18, TVIP11050 MG.1.6.03.05, TVIP20550 LM.1.6.18, TVIP10050 LM.1.6.18, TVIP11550 MG.1.6.03, TVIP21050 MG.1.6.03, and TVIP51550 MG.1.6.03 cameras allow remote attackers to execute code as root.
- Record
CVE-2018-17558- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-798, CWE-78
- Updated
- 2026-11-02
CVE List
Hardcoded manufacturer credentials and an OS command injection vulnerability in the /cgi-bin/mft/ directory on ABUS TVIP TVIP20050 LM.1.6.18, TVIP10051 LM.1.6.18, TVIP11050 MG.1.6.03.05, TVIP20550 LM.1.6.18, TVIP10050 LM.1.6.18, TVIP11550 MG.1.6.03, TVIP21050 MG.1.6.03, and TVIP51550 MG.1.6.03 cameras allow remote attackers to execute code as root.
- Record
CVE-2018-17558- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-78
- Updated
- 2026-11-02
EUVDEUVD-2018-9311
Hardcoded manufacturer credentials and an OS command injection vulnerability in the /cgi-bin/mft/ directory on ABUS TVIP TVIP20050 LM.1.6.18, TVIP10051 LM.1.6.18, TVIP11050 MG.1.6.03.05, TVIP20550 LM.1.6.18, TVIP10050 LM.1.6.18, TVIP11550 MG.1.6.03, TVIP21050 MG.1.6.03, and TVIP51550 MG.1.6.03 cameras allow remote attackers to execute code as root.
- Record
EUVD-2018-9311- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-03
GitHub AdvisoriesGHSA-fj49-xvp9-p96q
Hardcoded manufacturer credentials and an OS command injection vulnerability in the /cgi-bin/mft/...
Hardcoded manufacturer credentials and an OS command injection vulnerability in the /cgi-bin/mft/ directory on ABUS TVIP TVIP20050 LM.1.6.18, TVIP10051 LM.1.6.18, TVIP11050 MG.1.6.03.05, TVIP20550 LM.1.6.18, TVIP10050 LM.1.6.18, TVIP11550 MG.1.6.03, TVIP21050 MG.1.6.03, and TVIP51550 MG.1.6.03 cameras allow remote attackers to execute code as root.
- Record
GHSA-fj49-xvp9-p96q- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-78, CWE-798
- Updated
- 2026-11-02
Affected products
- abus tvip 10000 firmware
- abus tvip 10001 firmware
- abus tvip 10005 firmware
- abus tvip 10005a firmware
- abus tvip 10005b firmware
- abus tvip 10050 firmware
- abus tvip 10051 firmware
- abus tvip 10055a firmware
- abus tvip 10055b firmware
- abus tvip 10500 firmware
- abus tvip 10550 firmware
- abus tvip 11000 firmware
Show 35 moreShow less
- abus tvip 11050 firmware
- abus tvip 11500 firmware
- abus tvip 11501 firmware
- abus tvip 11502 firmware
- abus tvip 11550 firmware
- abus tvip 11551 firmware
- abus tvip 11552 firmware
- abus tvip 20000 firmware
- abus tvip 20050 firmware
- abus tvip 20500 firmware
- abus tvip 20550 firmware
- abus tvip 21000 firmware
- abus tvip 21050 firmware
- abus tvip 21500 firmware
- abus tvip 21501 firmware
- abus tvip 21502 firmware
- abus tvip 21550 firmware
- abus tvip 21551 firmware
- abus tvip 21552 firmware
- abus tvip 22500 firmware
- abus tvip 31000 firmware
- abus tvip 31001 firmware
- abus tvip 31050 firmware
- abus tvip 31500 firmware
- abus tvip 31501 firmware
- abus tvip 31550 firmware
- abus tvip 31551 firmware
- abus tvip 32500 firmware
- abus tvip 51500 firmware
- abus tvip 51550 firmware
- abus tvip 71500 firmware
- abus tvip 71501 firmware
- abus tvip 71550 firmware
- abus tvip 71551 firmware
- abus tvip 72500 firmware
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2018-17558 is a critical vulnerability (CVSS 9.8) in Abus Tvip 10000 Firmware, published October 26, 2023. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.94%, the 87th percentile. No source names a fixed version.