Sign-up

ID

VAR-201907-1081


CVE

CVE-2017-8229


TITLE

Amcrest IPM-721S Vulnerabilities related to certificate and password management in devices

Trust: 0.8

sources: JVNDB: JVNDB-2017-014567

DESCRIPTION

Amcrest IPM-721S V2.420.AC00.16.R.20160909 devices allow an unauthenticated attacker to download the administrative credentials. If the firmware version V2.420.AC00.16.R 9/9/2016 is dissected using binwalk tool, one obtains a _user-x.squashfs.img.extracted archive which contains the filesystem set up on the device that many of the binaries in the /usr folder. The binary "sonia" is the one that has the vulnerable function that sets up the default credentials on the device. If one opens this binary in IDA-pro one will notice that this follows a ARM little endian format. The function sub_436D6 in IDA pro is identified to be setting up the configuration for the device. If one scrolls to the address 0x000437C2 then one can see that /current_config is being set as an ALIAS for /mnt/mtd/Config folder on the device. If one TELNETs into the device and navigates to /mnt/mtd/Config folder, one can observe that it contains various files such as Account1, Account2, SHAACcount1, etc. This means that if one navigates to http://[IPofcamera]/current_config/Sha1Account1 then one should be able to view the content of the files. The security researchers assumed that this was only possible only after authentication to the device. However, when unauthenticated access tests were performed for the same URL as provided above, it was observed that the device file could be downloaded without any authentication. Amcrest IPM-721S The device contains vulnerabilities related to certificate and password management.Information is obtained, information is altered, and service operation is disrupted (DoS) There is a possibility of being put into a state. The Amcrest IPM-721S is a wireless IP camera from Amcrest. A security vulnerability exists in the AmcrestIPM-721SV2.420.AC00.16.R.20160909 release

Trust: 2.34

sources: NVD: CVE-2017-8229 // JVNDB: JVNDB-2017-014567 // CNVD: CNVD-2019-24194 // VULHUB: VHN-116432 // VULMON: CVE-2017-8229

IOT TAXONOMY

category:['Network device']sub_category: -

Trust: 0.6

sources: CNVD: CNVD-2019-24194

AFFECTED PRODUCTS

vendor:amcrestmodel:ipm-721sscope:lteversion:2.420.ac00.16.r.20160909

Trust: 1.0

vendor:amcrestmodel:ipm-721sscope:eqversion:2.420.ac00.16.r.20160909

Trust: 0.8

vendor:amcrestmodel:ipm-721s v2.420.ac00.16.r.20160909scope: - version: -

Trust: 0.6

sources: CNVD: CNVD-2019-24194 // JVNDB: JVNDB-2017-014567 // NVD: CVE-2017-8229

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2017-8229
value: CRITICAL

Trust: 1.0

NVD: CVE-2017-8229
value: CRITICAL

Trust: 0.8

CNVD: CNVD-2019-24194
value: MEDIUM

Trust: 0.6

CNNVD: CNNVD-201907-200
value: CRITICAL

Trust: 0.6

VULHUB: VHN-116432
value: MEDIUM

Trust: 0.1

VULMON: CVE-2017-8229
value: MEDIUM

Trust: 0.1

nvd@nist.gov: CVE-2017-8229
severity: MEDIUM
baseScore: 5.0
vectorString: AV:N/AC:L/AU:N/C:P/I:N/A:N
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: NONE
availabilityImpact: NONE
exploitabilityScore: 10.0
impactScore: 2.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.9

CNVD: CNVD-2019-24194
severity: MEDIUM
baseScore: 5.0
vectorString: AV:N/AC:L/AU:N/C:P/I:N/A:N
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: NONE
availabilityImpact: NONE
exploitabilityScore: 10.0
impactScore: 2.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.6

VULHUB: VHN-116432
severity: MEDIUM
baseScore: 5.0
vectorString: AV:N/AC:L/AU:N/C:P/I:N/A:N
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: NONE
availabilityImpact: NONE
exploitabilityScore: 10.0
impactScore: 2.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.1

nvd@nist.gov: CVE-2017-8229
baseSeverity: CRITICAL
baseScore: 9.8
vectorString: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: 3.9
impactScore: 5.9
version: 3.0

Trust: 1.8

sources: CNVD: CNVD-2019-24194 // VULHUB: VHN-116432 // VULMON: CVE-2017-8229 // JVNDB: JVNDB-2017-014567 // CNNVD: CNNVD-201907-200 // NVD: CVE-2017-8229

PROBLEMTYPE DATA

problemtype:CWE-255

Trust: 1.9

sources: VULHUB: VHN-116432 // JVNDB: JVNDB-2017-014567 // NVD: CVE-2017-8229

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-201907-200

TYPE

trust management problem

Trust: 0.6

sources: CNNVD: CNNVD-201907-200

CONFIGURATIONS

sources:
            
            
            JVNDB: JVNDB-2017-014567

PATCH
title:Top Pageurl:https://amcrest.com/
Trust: 0.8
title:AmcrestIPM-721S has an unspecified vulnerability (CNVD-2019-24194) patchurl:https://www.cnvd.org.cn/patchInfo/show/170547
Trust: 0.6
title:Amcrest IPM-721S Security vulnerabilitiesurl:http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=94394
Trust: 0.6
title:IoT_vulnerabilitiesurl:https://github.com/ethanhunnt/IoT_vulnerabilities 
Trust: 0.1
title:Threatposturl:https://threatpost.com/amcrest-critical-security-issues/145507/
Trust: 0.1
sources:
            
            
            CNVD: CNVD-2019-24194 // 
            
            
            
            VULMON: CVE-2017-8229 // 
            
            
            
            JVNDB: JVNDB-2017-014567 // 
            
            
            
            CNNVD: CNNVD-201907-200

EXTERNAL IDS
db:NVDid:CVE-2017-8229
Trust: 3.3
db:PACKETSTORMid:153224
Trust: 1.9
db:JVNDBid:JVNDB-2017-014567
Trust: 0.8
db:CNNVDid:CNNVD-201907-200
Trust: 0.7
db:CNVDid:CNVD-2019-24194
Trust: 0.6
db:VULHUBid:VHN-116432
Trust: 0.1
db:VULMONid:CVE-2017-8229
Trust: 0.1
sources:
            
            
            CNVD: CNVD-2019-24194 // 
            
            
            
            VULHUB: VHN-116432 // 
            
            
            
            VULMON: CVE-2017-8229 // 
            
            
            
            JVNDB: JVNDB-2017-014567 // 
            
            
            
            PACKETSTORM: 153224 // 
            
            
            
            CNNVD: CNNVD-201907-200 // 
            
            
            
            NVD: CVE-2017-8229

REFERENCES
url:https://github.com/ethanhunnt/iot_vulnerabilities/blob/master/amcrest_sec_issues.pdf
Trust: 2.6
url:https://nvd.nist.gov/vuln/detail/cve-2017-8229
Trust: 2.1
url:https://seclists.org/bugtraq/2019/jun/8
Trust: 1.8
url:http://packetstormsecurity.com/files/153224/amcrest-ipm-721s-credential-disclosure-privilege-escalation.html
Trust: 1.8
url:https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2017-8229
Trust: 0.8
url:https://cwe.mitre.org/data/definitions/255.html
Trust: 0.1
url:https://nvd.nist.gov
Trust: 0.1
url:https://threatpost.com/amcrest-critical-security-issues/145507/
Trust: 0.1
url:https://nvd.nist.gov/vuln/detail/cve-2017-8227
Trust: 0.1
url:https://nvd.nist.gov/vuln/detail/cve-2017-8226
Trust: 0.1
url:https://nvd.nist.gov/vuln/detail/cve-2017-8228
Trust: 0.1
url:https://nvd.nist.gov/vuln/detail/cve-2017-13719
Trust: 0.1
url:https://nvd.nist.gov/vuln/detail/cve-2017-8230
Trust: 0.1
sources:
            
            
            CNVD: CNVD-2019-24194 // 
            
            
            
            VULHUB: VHN-116432 // 
            
            
            
            VULMON: CVE-2017-8229 // 
            
            
            
            JVNDB: JVNDB-2017-014567 // 
            
            
            
            PACKETSTORM: 153224 // 
            
            
            
            CNNVD: CNNVD-201907-200 // 
            
            
            
            NVD: CVE-2017-8229

CREDITS
Mandar Satam
Trust: 0.1
sources:
            
            
            PACKETSTORM: 153224

SOURCES
db:CNVDid:CNVD-2019-24194
db:VULHUBid:VHN-116432
db:VULMONid:CVE-2017-8229
db:JVNDBid:JVNDB-2017-014567
db:PACKETSTORMid:153224
db:CNNVDid:CNNVD-201907-200
db:NVDid:CVE-2017-8229

LAST UPDATE DATE
2024-11-23T21:59:49.610000+00:00

SOURCES UPDATE DATE
db:CNVDid:CNVD-2019-24194date:2019-07-24T00:00:00
db:VULHUBid:VHN-116432date:2019-07-11T00:00:00
db:VULMONid:CVE-2017-8229date:2019-07-11T00:00:00
db:JVNDBid:JVNDB-2017-014567date:2019-07-12T00:00:00
db:CNNVDid:CNNVD-201907-200date:2019-07-12T00:00:00
db:NVDid:CVE-2017-8229date:2024-11-21T03:33:35.303

SOURCES RELEASE DATE
db:CNVDid:CNVD-2019-24194date:2019-07-22T00:00:00
db:VULHUBid:VHN-116432date:2019-07-03T00:00:00
db:VULMONid:CVE-2017-8229date:2019-07-03T00:00:00
db:JVNDBid:JVNDB-2017-014567date:2019-07-12T00:00:00
db:PACKETSTORMid:153224date:2019-06-07T15:06:02
db:CNNVDid:CNNVD-201907-200date:2019-07-03T00:00:00
db:NVDid:CVE-2017-8229date:2019-07-03T20:15:10.633