CVE-2017-5674

Exploitation likely. EPSS gives it a 22% chance of exploitation in the next 30 days. No fix published yet.

CVSS 3.09.8Critical EPSS percentile98th22% chance in 30 days CISA KEVNot listedNo confirmed exploitation
No public exploit known FixNone yetNo fix or workaround published

Published 2017-03-13Updated 2026-10-15Sources: CVE.org, NVD

NVD CVE.org

What to do

No fixed build or workaround is published yet. Limit exposure and watch for a patch.

Steps

Written by AI from the record

Identify IP cameras running a custom-built GoAhead web server and check whether their web-management interface is reachable from your network or the internet.
Remove direct internet access to affected camera web interfaces; allow management only through a VPN or restricted internal network.
No fixed version has been published; ask the camera maker or supplier whether your exact model has a firmware update or replacement available.
Change camera passwords after restricting access, especially passwords reused elsewhere.
Review access records for unusual requests for system.ini and replace any device whose vendor cannot provide a remedy.

May need vendor or contractor work

Is your organisation exposed?Request an assessment to establish which checks fit your systems.

What it is

From the CVE record

A vulnerability in a custom-built GoAhead web server used on Foscam, Vstarcam, and multiple white-label IP camera models allows an attacker to craft a malformed HTTP ("GET system.ini HTTP/1.1\n\n" - note the lack of "/" in the path field of the request) request that will disclose the configuration file with the login password.

In plain language

Written by AI from the record

Custom GoAhead web servers on some IP cameras can expose camera login passwords to anyone who can reach them, so affected small businesses should restrict access now because no fix is known.

Unauthenticated network information disclosure in custom-built GoAhead camera web servers allows a malformed HTTP request to retrieve system.ini, including device credentials.

If you're affected

Camera account takeover
Unauthorized camera viewing
Device settings exposure
Privacy breach
Operational disruption

What is it

This is a flaw in the web page used to manage certain IP cameras. It is like a stranger finding an incorrectly protected maintenance door and taking the notebook that contains the camera's login password.

Who is affected

This matters to you if you use IP cameras that run a custom-built GoAhead web server, including some Foscam, Vstarcam, and white-label camera models. An attacker does not need a camera account or anyone to click anything. It is only a risk if the camera's vulnerable web interface is reachable over the network.

How urgent is it

An attacker can remotely obtain camera credentials without an account, so treat this as an amber-priority exposure and restrict access promptly. There is no published fix information, no public exploit code on record, and the issue is not listed in CISA's known-exploited catalog; use network isolation and vendor escalation while awaiting a remedy.

What to do — in detail

Inventory camera models and firmware, then identify devices whose administration service is a custom-built GoAhead web server.
Confirm exposure by determining whether the camera web-management port is reachable from the internet, guest networks, or other untrusted network segments. Do not test the malformed request against production cameras unless authorized, as it would retrieve sensitive configuration data.
No vendor fixed version or supported branch remediation is available in the findings. Obtain a written answer from the camera vendor, reseller, or managed-service provider for each model; plan replacement if no firmware remedy is available.
Until a remedy is available, block inbound internet access to camera web interfaces, place cameras on a dedicated network, restrict administration to named management hosts or a VPN, and disable remote web administration if the device supports it.
Rotate camera passwords after containment, and rotate any password reused on other systems. Monitor camera, firewall, or proxy logs for malformed HTTP requests targeting system.ini.
CISA has not added this CVE to KEV, so there is no CISA remediation due date in the findings.

Technical context

CVE-2017-5674 is CVSS 9.8 Critical (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) and is classified as CWE-200. It is an unauthenticated network-accessible information disclosure: a malformed HTTP request without the expected slash in the request path can return system.ini containing credentials. EPSS predicts a 21.6% likelihood and places it in the 98th percentile, with a rising trend; this is predictive only. The CVE is not in CISA KEV, and no public exploit code is on record. No patch or fixed-version information is available.

This is a general assessment based on public vulnerability data. It does not account for your specific infrastructure — when in doubt, consult a security specialist.

Exploitation

Where each signal puts this CVE on the scale from published to confirmed exploited.

EPSS98th

CISA KEV

Not in the catalog. CISA has not confirmed exploitation.

Public exploits

No public exploit or proof of concept found in the sources we track.

EPSS

22% chance of exploitation activity in the next 30 days, which ranks it in the 98th percentile of scored CVEs.

Exploit Prediction Scoring System, FIRST.org. A probability, not a confirmation.

Lifecycle

24 events over 3503 days, from the signal feeds we watch.

2026-10-15Record updated
2026-09-28EPSS band changelow → moderate
2026-09-23EPSS band changelow → moderateepss band change
2026-09-21EPSS band changemoderate → lowepss band change
2026-09-06EPSS band change0 → moderateepss band change
2026-09-05EPSS band changemoderate → 0epss band change

Affected products

embedthiscommercialaka goahead, appweb
- goaheadOn-premNetworking Infrastructure / network-management

And 1 more affected product. See all after sign-in

Technical detail

CVSS 3.0 vector

Open in the CVSS calculator

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Scored 9.8 by NVD.

How it is reached

Attack Vector NetworkExploitable remotely over the network without any special conditions
Attack Complexity LowNo special conditions — the attack can be reliably reproduced
Privileges Required NoneNo authentication required — anyone can exploit this
User Interaction NoneNo user interaction needed — fully automated exploitation

Scope

Scope UnchangedImpact is limited to the vulnerable component itself

Impact if exploited

Confidentiality HighTotal information disclosure — all data in the component is compromised
Integrity HighTotal loss of integrity — attacker can modify any data in the component
Availability HighTotal denial of service — the component is completely unavailable