D-Link DCS-1100/DCS-1130 HTTP Management Interface /sbin RTSP Connection improper authentication

Summaryinfo

A vulnerability, which was classified as critical, has been found in D-Link DCS-1100 and DCS-1130. This vulnerability affects unknown code of the file /sbin of the component HTTP Management Interface. This manipulation as part of RTSP Connection causes improper authentication. This vulnerability appears as CVE-2017-8405. The attack may be initiated remotely. In addition, an exploit is available.

Detailsinfo

A vulnerability has been found in D-Link DCS-1100 and DCS-1130 (affected version unknown) and classified as critical. Affected by this vulnerability is an unknown functionality of the file /sbin of the component HTTP Management Interface. The manipulation as part of a RTSP Connection leads to a improper authentication vulnerability. The CWE definition for the vulnerability is CWE-287. When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct. As an impact it is known to affect confidentiality, integrity, and availability. The summary by CVE is:

An issue was discovered on D-Link DCS-1130 and DCS-1100 devices. The binary rtspd in /sbin folder of the device handles all the rtsp connections received by the device. It seems that the binary loads at address 0x00012CF4 a flag called "Authenticate" that indicates whether a user should be authenticated or not before allowing access to the video feed. By default, the value for this flag is zero and can be set/unset using the HTTP interface and network settings tab as shown below. The device requires that a user logging to the HTTP management interface of the device to provide a valid username and password. However, the device does not enforce the same restriction by default on RTSP URL due to the checkbox unchecked by default, thereby allowing any attacker in possession of external IP address of the camera to view the live video feed. The severity of this attack is enlarged by the fact that there more than 100,000 D-Link devices out there.

The weakness was presented 07/02/2019 as not defined mailinglist post (Bugtraq). The advisory is shared at seclists.org. This vulnerability is known as CVE-2017-8405 since 05/02/2017. The exploitation appears to be easy. The attack can be launched remotely. The exploitation doesn't need any form of authentication. Technical details and also a public exploit are known.

After immediately, there has been an exploit disclosed. It is possible to download the exploit at seclists.org. It is declared as proof-of-concept. We expect the 0-day to have been worth approximately $5k-$25k.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

See VDB-136204, VDB-136205, VDB-136206 and VDB-136207 for similar entries. If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Productinfo

Vendor

• D-Link

Name

• DCS-1100
• DCS-1130

License

• commercial

Website

• Vendor: https://www.dlink.com/

CPE 2.3info

• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion