P2pcam (57.0.0.0308) - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/products/p2pcam-57.0.0.0308/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioMon, 28 Sep 2026 06:47:04 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgRemote Stack-based Buffer Overflow in Eyeplus p2pcam HTTP Parserhttps://feed.craftedsignal.io/briefs/2026-09-eyeplus-overflow/Mon, 28 Sep 2026 06:47:04 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-09-eyeplus-overflow/A stack-based buffer overflow vulnerability in the p2pcam HTTP Parser component of Eyeplus 57.0.0.0308 allows remote attackers to execute arbitrary code via crafted HTTP requests.A stack-based buffer overflow vulnerability (CVE-2026-100908) has been identified in the p2pcam HTTP Parser component of Eyeplus version 57.0.0.0308. The vulnerability originates from improper bounds checking within an unknown function of the parser, allowing a remote attacker to trigger a buffer overflow condition. By sending a maliciously crafted HTTP request, an unauthorized remote actor can overwrite adjacent memory, potentially leading to arbitrary code execution on the target device. Publicly disclosed exploit code for this vulnerability is currently available, significantly lowering the barrier to entry for attackers. Given the nature of the p2pcam component, this risk is particularly acute for Internet-facing surveillance and camera hardware running the affected firmware version.

Impact

Successful exploitation allows for unauthenticated remote code execution on the affected device, potentially leading to a complete compromise of the system, data exfiltration, or the recruitment of the device into a botnet. The severity is rated at 7.5 (CVSS v3.1), reflecting the potential for full system control by remote actors.

Recommendation

  • Identify all internet-facing devices running Eyeplus firmware version 57.0.0.0308.
  • Restrict network access to the p2pcam HTTP interface to trusted internal segments only, as this is a remote-exploitable vulnerability.
  • Contact the vendor for a security patch or firmware update addressing CVE-2026-100908.
  • Monitor ingress traffic on ports associated with the p2pcam web interface for anomalous HTTP payloads, specifically looking for abnormally long URI strings or unexpected character sequences.
]]>lowadvisoryvulnerabilityrcebuffer-overflow