Amcrest IPM-721S V2.420.AC00.16.R.20160909 Cloud access control

Summaryinfo

A vulnerability was found in Amcrest IPM-721S V2.420.AC00.16.R.20160909. It has been rated as critical. This affects an unknown part of the component Cloud Handler. The manipulation leads to access control. This vulnerability is traded as CVE-2017-8228. It is possible to initiate the attack remotely. There is no exploit available.

Detailsinfo

A vulnerability was found in Amcrest IPM-721S V2.420.AC00.16.R.20160909. It has been rated as critical. This issue affects an unknown function of the component Cloud Handler. The manipulation with an unknown input leads to a access control vulnerability. Using CWE to declare the problem leads to CWE-264. Impacted is confidentiality, integrity, and availability. The summary by CVE is:

Amcrest IPM-721S V2.420.AC00.16.R.20160909 devices mishandle reboots within the past two hours. Amcrest cloud services does not perform a thorough verification when allowing the user to add a new camera to the user's account to ensure that the user actually owns the camera other than knowing the serial number of the camera. This can allow an attacker who knows the serial number to easily add another user's camera to an attacker's cloud account and control it completely. This is possible in case of any camera that is currently not a part of an Amcrest cloud account or has been removed from the user's cloud account. Also, another requirement for a successful attack is that the user should have rebooted the camera in the last two hours. However, both of these conditions are very likely for new cameras that are sold over the Internet at many ecommerce websites or vendors that sell the Amcrest products. The successful attack results in an attacker being able to completely control the camera which includes being able to view and listen on what the camera can see, being able to change the motion detection settings and also be able to turn the camera off without the user being aware of it. Note: The same attack can be executed using the Amcrest Cloud mobile application.

The weakness was shared 07/03/2019 as not defined mailinglist post (Bugtraq). The advisory is shared at seclists.org. The identification of this vulnerability is CVE-2017-8228 since 04/25/2017. The attack may be initiated remotely. The successful exploitation requires a simple authentication. It demands that the victim is doing some kind of user interaction. Neither technical details nor an exploit are publicly available. MITRE ATT&CK project uses the attack technique T1068 for this issue.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

The entries VDB-136204, VDB-136205, VDB-136206 and VDB-136207 are related to this item. Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Productinfo

Vendor

• Amcrest

Name

• IPM-721S

Version

• V2.420.AC00.16.R.20160909

CPE 2.3info

• 🔍

CPE 2.2info

• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion