A vulnerability, which was classified as critical, has been found in Shenzhen Cylan Clever Dog Smart Camera DOG-2W and Cylan Clever Dog Smart Camera DOG-2W-V4 (affected version unknown). Affected by this issue is an unknown functionality of the component Telnet Service. The manipulation with the input value 12345678 leads to a hard-coded credentials vulnerability. Using CWE to declare the problem leads to CWE-798. The product contains hard-coded credentials, such as a password or cryptographic key, which it uses for its own inbound authentication, outbound communication to external components, or encryption of internal data. Impacted is confidentiality, integrity, and availability. CVE summarizes:

On Shenzhen Cylan Clever Dog Smart Camera DOG-2W and DOG-2W-V4 devices, an attacker on the network can login remotely to the camera and gain root access. The device ships with a hardcoded 12345678 password for the root account, accessible from a TELNET login prompt.

The weakness was disclosed 06/20/2019. This vulnerability is handled as CVE-2019-12920 since 06/20/2019. The attack may be launched remotely. No form of authentication is required for exploitation. Technical details are known, but there is no available exploit. This vulnerability is assigned to T1110.001 by the MITRE ATT&CK project.

Addressing this vulnerability is possible by firewalling .

The entry 136801 is pretty similar.

Productinfo

Vendor

• Shenzhen

Name

• Cylan Clever Dog Smart Camera DOG-2W
• Cylan Clever Dog Smart Camera DOG-2W-V4

CPE 2.3info

• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Discussion