Description

A vulnerability has been found in Eyeplus 57.0.0.0308. This affects an unknown function of the component p2pcam HTTP Parser. Such manipulation leads to stack-based buffer overflow. The attack may be performed from remote. The exploit has been disclosed to the public and may be used.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-09-28T05:16:29.877Z",
  "pubdate": "2026-09-28T05:16:29.877Z",
  "executiveSummary": "A critical security vulnerability has been identified in the p2pcam HTTP Parser component within Eyeplus version 57.0.0.0308. The vulnerability is classified as a stack-based buffer overflow, which may allow a remote, unauthenticated attacker to execute arbitrary code or cause a denial-of-service condition on the target system.\nThis flaw resides in the handling of incoming HTTP traffic by the p2pcam service. Successful exploitation does not require prior authentication, allowing remote threat actors to manipulate memory structures to overwrite the stack, potentially leading to arbitrary code execution with the privileges of the affected service.\nGiven that the exploit code has been publicly disclosed, the risk of active exploitation is significant. Organizations utilizing this version of Eyeplus are advised to prioritize mitigation efforts immediately to prevent unauthorized access or system compromise, as the flaw provides a direct path for remote attackers to hijack the device's execution flow.",
  "technicalDetails": "The vulnerability manifests within the p2pcam HTTP Parser component of the Eyeplus 57.0.0.0308 application. The root cause is an improper bounds check during the processing of incoming HTTP requests. When the parser receives a crafted HTTP packet containing an excessively large payload, the underlying memory management routines fail to adequately validate the input size before copying it into a fixed-length stack-based buffer.\nIn a standard stack-based buffer overflow scenario within the p2pcam context, the attacker transmits a specially crafted HTTP request over the network. This payload is designed to exceed the allocated capacity of the destination buffer on the stack. As the input is copied into the buffer, the excess data overflows the buffer boundaries, allowing the attacker to overwrite critical stack control data, including the saved frame pointer and the return address of the calling function.\nThe attack flow proceeds as follows: 1) The attacker establishes a network connection to the Eyeplus p2pcam service. 2) The attacker crafts an HTTP request containing an oversized string or binary sequence intended to trigger the overflow. 3) The service's HTTP Parser processes this request without verifying the length of the header fields or payload parameters. 4) The stack memory is corrupted, allowing the attacker to redirect the instruction pointer (EIP/RIP) to a location controlled by the attacker. This location typically contains shellcode or is redirected to existing code sequences (Return-Oriented Programming) to achieve execution of arbitrary commands.\nBecause the p2pcam HTTP Parser is accessible remotely, the vulnerability is exposed to any network-reachable instance of Eyeplus 57.0.0.0308. No authentication is required to interact with the vulnerable component, lowering the barrier to entry for attackers. The impact of successful exploitation includes potential remote code execution, which facilitates full system compromise, data theft, or the installation of persistent malicious implants. Given that the exploit code is publicly disclosed, the process of weaponizing this vulnerability is straightforward, increasing the probability of exploitation attempts by automated botnets and targeted threat actors."
}