Amcrest IPM-721S V2.420.AC00.16.R.20160909 sub_436D6 credentials management

Summaryinfo

A vulnerability categorized as problematic has been discovered in Amcrest IPM-721S V2.420.AC00.16.R.20160909. This vulnerability affects the function sub_436D6. The manipulation results in credentials management. This vulnerability is known as CVE-2017-8229. It is possible to launch the attack remotely. No exploit is available.

Detailsinfo

A vulnerability classified as problematic has been found in Amcrest IPM-721S V2.420.AC00.16.R.20160909. Affected is the function sub_436D6. The manipulation with an unknown input leads to a credentials management vulnerability. CWE is classifying the issue as CWE-255. This is going to have an impact on confidentiality. CVE summarizes:

Amcrest IPM-721S V2.420.AC00.16.R.20160909 devices allow an unauthenticated attacker to download the administrative credentials. If the firmware version V2.420.AC00.16.R 9/9/2016 is dissected using binwalk tool, one obtains a _user-x.squashfs.img.extracted archive which contains the filesystem set up on the device that many of the binaries in the /usr folder. The binary "sonia" is the one that has the vulnerable function that sets up the default credentials on the device. If one opens this binary in IDA-pro one will notice that this follows a ARM little endian format. The function sub_436D6 in IDA pro is identified to be setting up the configuration for the device. If one scrolls to the address 0x000437C2 then one can see that /current_config is being set as an ALIAS for /mnt/mtd/Config folder on the device. If one TELNETs into the device and navigates to /mnt/mtd/Config folder, one can observe that it contains various files such as Account1, Account2, SHAACcount1, etc. This means that if one navigates to http://[IPofcamera]/current_config/Sha1Account1 then one should be able to view the content of the files. The security researchers assumed that this was only possible only after authentication to the device. However, when unauthenticated access tests were performed for the same URL as provided above, it was observed that the device file could be downloaded without any authentication.

The weakness was published 07/03/2019 as not defined mailinglist post (Bugtraq). The advisory is available at seclists.org. This vulnerability is traded as CVE-2017-8229 since 04/25/2017. It is possible to launch the attack remotely. The exploitation doesn't require any form of authentication. Technical details are known, but there is no available exploit. This vulnerability is assigned to T1552 by the MITRE ATT&CK project.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

Similar entries are available at VDB-136204, VDB-136205, VDB-136206 and VDB-136207. If you want to get best quality of vulnerability data, you may have to visit VulDB.

Productinfo

Vendor

• Amcrest

Name

• IPM-721S

Version

• V2.420.AC00.16.R.20160909

CPE 2.3info

• 🔍

CPE 2.2info

• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Discussion