Security readout for executives and security teams
Plain-English summary
This issue affects Faleemi FSC-880 cameras running firmware 00.01.01.0048P2. An unauthenticated attacker could abuse an SQL injection flaw in the ONVIF service to access sensitive data, including the admin password. Treat exposed cameras as high-risk until isolated and verified.
Executive priority
Prioritize remediation if these cameras are internet-facing or on sensitive networks. The main business risk is unauthorized camera administration or credential exposure from a low-barrier, unauthenticated flaw.
Technical view
CVE-2017-14743 describes unauthenticated SQL injection through the Username element in an XML document handled by /onvif/device_service. The public CVE text says the issue was demonstrated by reading the admin password. The record provides no CVSS, CWE, CPE, or confirmed vendor fix.
Likely exposure
Exposure is most likely on Faleemi FSC-880 devices running 00.01.01.0048P2, especially cameras reachable from the internet or from untrusted internal networks. The source bundle does not identify other affected models or firmware versions.
Exploitation context
The cited public advisory describes a working demonstration, but the source bundle does not show CISA KEV listing or evidence of active exploitation in the wild. Public technical details still increase risk for reachable devices.
Researcher notes
Evidence is limited to CVE metadata and the cited public write-up. The record lacks scoring, CPEs, CWE mapping, and vendor remediation details. Avoid broad product assumptions beyond Faleemi FSC-880 firmware 00.01.01.0048P2.
Mitigation direction
- Identify any Faleemi FSC-880 cameras and record firmware versions.
- Remove affected cameras from direct internet exposure immediately.
- Restrict ONVIF access to trusted management networks or VPN only.
- Check vendor guidance for firmware updates or replacement options.
- Rotate camera credentials after containment and remediation.
- Replace unsupported devices if no vendor-supported fix is available.
Validation and detection
- Inventory camera models and confirm firmware version 00.01.01.0048P2 exposure.
- Review firewall rules for access to the camera ONVIF service.
- Check logs for unauthenticated requests to /onvif/device_service.
- Verify cameras are segmented from untrusted networks.
- Confirm vendor firmware or lifecycle status before closing the finding.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
Credential and access behavior lookup
The CVE wording references authentication or credential exposure, so valid-account and credential-access review may help. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.
Open ATT&CK lookupDatabase behavior lookup
The CVE wording references database injection or access, so collection and exfiltration review may help. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.
Open ATT&CK lookupCVE-2017-14743 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS and timeline data
No CVSS vectors or timeline events were available in the normalized CVE source material.
Source materials
- CVE List V5 sourceCVE List V5
- https://medium.com/iotsploit/faleemi-fsc-880-multiple-security-vulnerabilities-ed1d132c2cceCVE reference · x_refsource_MISC
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.