CVE-2014-1901
Severity CVSS v4.0:
Pending analysis
Type:
CWE-20
Input Validation
Publication date:
14/05/2015
Last modified:
12/04/2025
Description
Y-Cam camera models SD range YCB003, YCK003, and YCW003; S range YCB004, YCK004, YCW004; EyeBall YCEB03; Bullet VGA YCBL03 and YCBLB3; Bullet HD 720 YCBLHD5; Y-cam Classic Range YCB002, YCK002, and YCW003; and Y-cam Original Range YCB001, YCW001, running firmware 4.30 and earlier, allow remote authenticated users to cause a denial of service (reboot) via a malformed (1) path parameter to en/store_main.asp, (2) item parameter to en/account/accedit.asp, or (3) emailid parameter to en/smtpclient.asp. NOTE: this issue can be exploited without authentication by leveraging CVE-2014-1900.
Impact
Base Score 2.0
6.80
Severity 2.0
MEDIUM
Vulnerable products and versions
| CPE | From | Up to |
|---|---|---|
| cpe:2.3:o:y-cam:yceb03_firmware:4.30:*:*:*:*:*:*:* | ||
| cpe:2.3:h:y-cam:yceb03:*:*:*:*:*:*:*:* | ||
| cpe:2.3:o:y-cam:ycb004_firmware:4.30:*:*:*:*:*:*:* | ||
| cpe:2.3:h:y-cam:ycb004:*:*:*:*:*:*:*:* | ||
| cpe:2.3:o:y-cam:ycb002_firmware:4.30:*:*:*:*:*:*:* | ||
| cpe:2.3:h:y-cam:ycb002:*:*:*:*:*:*:*:* | ||
| cpe:2.3:o:y-cam:ycbl03_firmware:4.30:*:*:*:*:*:*:* | ||
| cpe:2.3:h:y-cam:ycbl03:*:*:*:*:*:*:*:* | ||
| cpe:2.3:o:y-cam:ycblb3_firmware:4.30:*:*:*:*:*:*:* | ||
| cpe:2.3:h:y-cam:ycblb3:*:*:*:*:*:*:*:* | ||
| cpe:2.3:o:y-cam:yck002_firmware:4.30:*:*:*:*:*:*:* | ||
| cpe:2.3:h:y-cam:yck002:*:*:*:*:*:*:*:* | ||
| cpe:2.3:o:y-cam:ycblhd5_firmware:4.30:*:*:*:*:*:*:* | ||
| cpe:2.3:h:y-cam:ycblhd5:*:*:*:*:*:*:*:* | ||
| cpe:2.3:o:y-cam:ycw003_firmware:4.30:*:*:*:*:*:*:* |
To consult the complete list of CPE names with products and versions, see this page