Vulnerability Description
Amcrest IPM-721S V2.420.AC00.16.R.20160909 devices have default credentials that are hardcoded in the firmware and can be extracted by anyone who reverses the firmware to identify them. If the firmware version V2.420.AC00.16.R 9/9/2016 is dissected using binwalk tool, one obtains a _user-x.squashfs.img.extracted archive which contains the filesystem set up on the device that many of the binaries in the /usr folder. The binary "sonia" is the one that has the vulnerable function that sets up the default credentials on the device. If one opens this binary in IDA-pro, one will notice that this follows a ARM little endian format. The function sub_3DB2FC in IDA pro is identified to be setting up the values at address 0x003DB5A6. The sub_5C057C then sets this value and adds it to the Configuration files in /mnt/mtd/Config/Account1 file.
CVSS Score
CRITICAL
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Amcrest | Ipm-721S Firmware | <= 2.420.ac00.16.r.20160909 |
| Amcrest | Ipm-721S | - |
Related Weaknesses (CWE)
References
- http://packetstormsecurity.com/files/153224/Amcrest-IPM-721S-Credential-DisclosuThird Party AdvisoryVDB Entry
- https://github.com/ethanhunnt/IoT_vulnerabilities/blob/master/Amcrest_sec_issuesExploitThird Party Advisory
- https://seclists.org/bugtraq/2019/Jun/8Mailing ListThird Party Advisory
- http://packetstormsecurity.com/files/153224/Amcrest-IPM-721S-Credential-DisclosuThird Party AdvisoryVDB Entry
- https://github.com/ethanhunnt/IoT_vulnerabilities/blob/master/Amcrest_sec_issuesExploitThird Party Advisory
- https://seclists.org/bugtraq/2019/Jun/8Mailing ListThird Party Advisory
FAQ
What is CVE-2017-8226?
CVE-2017-8226 is a vulnerability with a CVSS score of 9.8 (CRITICAL). Amcrest IPM-721S V2.420.AC00.16.R.20160909 devices have default credentials that are hardcoded in the firmware and can be extracted by anyone who reverses the firmware to identify them. If the firmwar...
How severe is CVE-2017-8226?
CVE-2017-8226 has been rated CRITICAL with a CVSS base score of 9.8/10. This is considered a critical vulnerability requiring immediate attention.
Is there a patch for CVE-2017-8226?
Check the references section above for vendor advisories and patch information. Affected products include: Amcrest Ipm-721S Firmware, Amcrest Ipm-721S.