CVE:CVE-2014-1902
CNNVD:CNNVD-201505-210
Y-Cam camera models SD range YCB003等都是英国Y-Cam公司的网络摄像机产品。
多款Y-Cam产品中存在跨站脚本漏洞，该漏洞源于en/identity.asp文件没有充分过滤‘SYSCONTACT’参数；en/account/accedit.asp文件没有充分过滤‘PASSWD’参数；en/clock.asp文件没有充分过滤‘NTPSERVER’参数；en/smtpclient.asp文件没有充分过滤‘SERVER’参数；en/ftp.asp文件没有充分过滤‘SERVER’参数；en/httpevent.asp文件没有充分过滤‘SERVER’参数。远程攻击者可利用该漏洞注入任意Web脚本或HTML。
solution:Upgrade y-cam ycb004_firmware to a higher version than 4.30,and avoid the version 4.30; Upgrade y-cam ycb002_firmware to a higher version than 4.30,and avoid the version 4.30; Upgrade y-cam yck002_firmware to a higher version than 4.30,and avoid the version 4.30; Upgrade y-cam yck003_firmware to a higher version than 4.30,and avoid the version 4.30; Upgrade y-cam yceb03_firmware to a higher version than 4.30,and avoid the version 4.30; Upgrade y-cam ycb001_firmware to a higher version than 4.30,and avoid the version 4.30; Upgrade y-cam ycblhd5_firmware to a higher version than 4.30,and avoid the version 4.30; Upgrade y-cam ycblb3_firmware to a higher version than 4.30,and avoid the version 4.30; Upgrade y-cam ycblb3 to a higher version than *; Upgrade y-cam ycb003_firmware to a higher version than 4.30,and avoid the version 4.30; Upgrade y-cam ycw003_firmware to a higher version than 4.30,and avoid the version 4.30; Upgrade y-cam ycw004_firmware to a higher version than 4.30,and avoid the version 4.30; Upgrade y-cam ycw004 to a higher version than *; Upgrade y-cam ycbl03_firmware to a higher version than 4.30,and avoid the version 4.30; Upgrade y-cam ycbl03 to a higher version than *; Upgrade y-cam yck004_firmware to a higher version than 4.30,and avoid the version 4.30; Upgrade y-cam ycw001_firmware to a higher version than 4.30,and avoid the version 4.30; Upgrade y-cam ycw002_firmware to a higher version than 4.30,and avoid the version 4.30