Vulnerability Description
Multiple models of the Uniview IP Camera (e.g., IPC_G6103 B6103.16.10.B25.201218, IPC_G61, IPC21, IPC23, IPC32, IPC36, IPC62, and IPC_HCMN) offer an undocumented UDP service on port 7788 that allows a remote unauthenticated attacker to overflow an internal buffer and achieve code execution. By using this buffer overflow, a remote attacker can start the telnetd service. This service has a hardcoded default username and password (root/123456). Although it has a restrictive shell, this can be easily bypassed via the built-in ECHO shell command.
CVSS Score
CRITICAL
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Uniview | Camera Firmware | - |
Related Weaknesses (CWE)
References
- https://ssd-disclosure.com/ssd-advisory--uniview-preauth-rce/ExploitThird Party Advisory
- https://www.uniview.com/About_Us/Security/Notice/202112/920471_140493_0.htmVendor Advisory
- https://ssd-disclosure.com/ssd-advisory--uniview-preauth-rce/ExploitThird Party Advisory
- https://www.uniview.com/About_Us/Security/Notice/202112/920471_140493_0.htmVendor Advisory
FAQ
What is CVE-2021-45039?
CVE-2021-45039 is a vulnerability with a CVSS score of 9.8 (CRITICAL). Multiple models of the Uniview IP Camera (e.g., IPC_G6103 B6103.16.10.B25.201218, IPC_G61, IPC21, IPC23, IPC32, IPC36, IPC62, and IPC_HCMN) offer an undocumented UDP service on port 7788 that allows a...
How severe is CVE-2021-45039?
CVE-2021-45039 has been rated CRITICAL with a CVSS base score of 9.8/10. This is considered a critical vulnerability requiring immediate attention.
Is there a patch for CVE-2021-45039?
Check the references section above for vendor advisories and patch information. Affected products include: Uniview Camera Firmware.