Amcrest IPM-721S V2.420.AC00.16.R.20160909 sub_3DB2FC hard-coded credentials

Summaryinfo

A vulnerability was found in Amcrest IPM-721S V2.420.AC00.16.R.20160909. It has been classified as critical. Affected by this vulnerability is the function sub_3DB2FC. Performing a manipulation results in hard-coded credentials. This vulnerability is reported as CVE-2017-8226. The attack is possible to be carried out remotely. No exploit exists.

Detailsinfo

A vulnerability was found in Amcrest IPM-721S V2.420.AC00.16.R.20160909. It has been classified as critical. This affects the function sub_3DB2FC. The manipulation with an unknown input leads to a hard-coded credentials vulnerability. CWE is classifying the issue as CWE-798. The product contains hard-coded credentials, such as a password or cryptographic key, which it uses for its own inbound authentication, outbound communication to external components, or encryption of internal data. This is going to have an impact on confidentiality, integrity, and availability. The summary by CVE is:

Amcrest IPM-721S V2.420.AC00.16.R.20160909 devices have default credentials that are hardcoded in the firmware and can be extracted by anyone who reverses the firmware to identify them. If the firmware version V2.420.AC00.16.R 9/9/2016 is dissected using binwalk tool, one obtains a _user-x.squashfs.img.extracted archive which contains the filesystem set up on the device that many of the binaries in the /usr folder. The binary "sonia" is the one that has the vulnerable function that sets up the default credentials on the device. If one opens this binary in IDA-pro, one will notice that this follows a ARM little endian format. The function sub_3DB2FC in IDA pro is identified to be setting up the values at address 0x003DB5A6. The sub_5C057C then sets this value and adds it to the Configuration files in /mnt/mtd/Config/Account1 file.

The weakness was disclosed 07/03/2019 as not defined mailinglist post (Bugtraq). It is possible to read the advisory at seclists.org. This vulnerability is uniquely identified as CVE-2017-8226 since 04/25/2017. It is possible to initiate the attack remotely. No form of authentication is needed for exploitation. Technical details of the vulnerability are known, but there is no available exploit. The attack technique deployed by this issue is T1110.001 according to MITRE ATT&CK.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

The entries VDB-136204, VDB-136205, VDB-136206 and VDB-136207 are pretty similar. Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Vendor

• Amcrest

Name

• IPM-721S

Version

• V2.420.AC00.16.R.20160909

CPE 2.3info

• 🔍

CPE 2.2info

• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion