Amcrest IPM-721S V2.420.AC00.16.R.20160909 Protection Mechanism sub_59F4C 7pk security

Summaryinfo

A vulnerability was found in Amcrest IPM-721S V2.420.AC00.16.R.20160909. It has been declared as problematic. Affected by this issue is the function sub_59F4C of the component Protection Mechanism. Executing a manipulation can lead to 7pk security. This vulnerability appears as CVE-2017-8227. The attack may be performed from remote. There is no available exploit.

Detailsinfo

A vulnerability was found in Amcrest IPM-721S V2.420.AC00.16.R.20160909. It has been declared as critical. This vulnerability affects the function sub_59F4C of the component Protection Mechanism. The manipulation with an unknown input leads to a 7pk security vulnerability. The CWE definition for the vulnerability is CWE-254. As an impact it is known to affect confidentiality, integrity, and availability. CVE summarizes:

Amcrest IPM-721S V2.420.AC00.16.R.20160909 devices have a timeout policy to wait for 5 minutes in case 30 incorrect password attempts are detected using the Web and HTTP API interface provided by the device. However, if the same brute force attempt is performed using the ONVIF specification (which is supported by the same binary) then there is no account lockout or timeout executed. This can allow an attacker to circumvent the account protection mechanism and brute force the credentials. If the firmware version V2.420.AC00.16.R 9/9/2016 is dissected using binwalk tool, one obtains a _user-x.squashfs.img.extracted archive which contains the filesystem set up on the device that many of the binaries in the /usr folder. The binary "sonia" is the one that has the vulnerable function that performs the credential check in the binary for the ONVIF specification. If one opens this binary in IDA-pro one will notice that this follows a ARM little endian format. The function at address 00671618 in IDA pro is parses the WSSE security token header. The sub_ 603D8 then performs the authentication check and if it is incorrect passes to the function sub_59F4C which prints the value "Sender not authorized."

The weakness was presented 07/03/2019 as not defined mailinglist post (Bugtraq). The advisory is shared for download at seclists.org. This vulnerability was named CVE-2017-8227 since 04/25/2017. The attack can be initiated remotely. No form of authentication is required for a successful exploitation. There are known technical details, but no exploit is available. The MITRE ATT&CK project declares the attack technique as T1211.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

See VDB-136204, VDB-136205, VDB-136206 and VDB-136207 for similar entries. VulDB is the best source for vulnerability data and more expert information about this specific topic.

Productinfo

Vendor

• Amcrest

Name

• IPM-721S

Version

• V2.420.AC00.16.R.20160909

CPE 2.3info

• 🔍

CPE 2.2info

• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion