{"uuid": "8e63d42b-bf87-40b1-85a0-691b1df71919", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-41506", "type": "seen", "source": "https://gist.github.com/TheFury4/370c01a013f8a1d3af34a5adcae1c67b", "content": "# Xiongmai XM530: UART console auto-login as root\n\n| Field | Value |\n| --- | --- |\n| Vendor | Hangzhou Xiongmai Technology Co., Ltd. |\n| Product | XM530 IP Camera firmware (OEM / white-label) |\n| Hardware | XM530_R80X20-PQ_8M |\n| Version | V5.00.R02.20210818 |\n| Request tracking | (second CAN \u2014 paste the CAN-2026-* assigned by the portal) |\n| CVE | Reserved / pending MITRE CNA-LR |\n| CWE | CWE-306 |\n| CVSS v3.1 | 6.8 (`AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H`) |\n| CVSS v4.0 | 7.0 (`AV:P/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N`) |\n| Attack vector | Physical (UART / `ttyS000`, 115200 8N1) |\n| Discovery | External, offline static analysis |\n| Date | 9 September 2026 |\n| Finder | emanu066@gmail.com |\n\nThis advisory is self-contained. A reviewer can confirm the defect against the official firmware image using the hashes and extracts below. No live camera or exploit payload is required.\n\n---\n\n## Summary\n\nBusyBox init starts `getty` on the serial console with `-n root`, which skips authentication and drops to an interactive root shell. Physical access to the UART pads is sufficient.\n\n---\n\n## Affected image\n\n| Item | Value |\n| --- | --- |\n| Filename | `General_IPC_XM530_R80X20-PQ_WIFIXM711.711.Nat.dss.OnvifS_V5.00.R02.20210818_all.bin` |\n| Size | 6,784,000 bytes |\n| SHA-256 | `d75262b6dfef74144fda52234df273963bdc6001133bd5e8aab570a6de4e16b8` |\n| MD5 | `1443425028aa074ad9e0370830cb82e3` |\n| Device ID | `000306951001000000600000` |\n| Partition | `romfs-x.cramfs.img` (CramFS, SHA-256 `e5a956ae8e1f572da9ea0355410639d6b2fe170bc0e93237ebc0b05b634887fc`) |\n| Config file | `/etc/inittab` |\n\nOther XM530 OEM builds that ship the same `getty -n root` line may be affected. That was not surveyed.\n\n---\n\n## Description\n\n`/etc/inittab` contains:\n\n```text\n::respawn:/sbin/getty -L ttyS000 115200 vt100 -n root -I \"Auto login as root ...\"\n```\n\nBusyBox `getty -n USER` does not prompt for a password. The console is also selected in the U-Boot environment (`console=ttyAMA0,115200`). A physically present attacker with a 3.3 V UART adapter on `ttyS000` / `ttyAMA0` at 115200 8N1 obtains a root shell without credentials.\n\nThis is independent of `/etc/passwd`. Auto-login does not consult the `xmhdipc` hash. That factory password is already tracked as **CVE-2021-41506** and is **not** this vulnerability.\n\n---\n\n## Evidence from this image\n\n### 1. Complete `/etc/inittab`\n\nFile: cramfs `romfs-x.cramfs.img` \u2192 `/etc/inittab`\n\n```text\n::sysinit:/etc/init.d/rcS\n#::askfirst:/bin/sh\n\n::respawn:/sbin/getty -L ttyS000 115200 vt100 -n root -I \"Auto login as root ...\"\n\n::ctrlaltdel:/sbin/reboot\n::shutdown:/bin/umount -a -r\n::restart:/sbin/init\n```\n\nThe usual interactive line `#::askfirst:/bin/sh` is commented out. The live `getty` line is the one with `-n root`.\n\nBusyBox documentation: `-n` skip login; the following argument is the username. Here that username is `root`.\n\n### 2. Kernel console in U-Boot environment\n\nFile: `u-boot.env.img`\n\n```text\nbootargs=mem=35M console=ttyAMA0,115200 root=/dev/mtdblock2 rootfstype=cramfs mtdparts=xm_sfc:256K(boot),1536K(kernel),1280K(romfs),4544K(user),256K(custom),320K(mtd)\n```\n\n### 3. Not this CVE (recorded only to prevent mix-up)\n\nFile: `/etc/passwd`\n\n```text\nroot:$1$RYIwEiRA$d5iRRVQ5ZeRTrJwGjRy.B0:0:0:root:/:/bin/sh\n```\n\n`openssl passwd -1 -salt RYIwEiRA xmhdipc` reproduces that hash. That is CVE-2021-41506. Do not merge it into this ID.\n\n---\n\n## How a reviewer verifies this (no device needed)\n\n1. Hash the firmware blob; it must match  \n   `d75262b6dfef74144fda52234df273963bdc6001133bd5e8aab570a6de4e16b8`.\n2. Unzip; extract `romfs-x.cramfs.img`.\n3. Read `/etc/inittab`. The `getty` line must contain `-n root`.\n4. Optionally extract strings from `u-boot.env.img` and confirm `console=ttyAMA0,115200`.\n\nThat is sufficient. Attaching a UART cable to hardware only reproduces the same init policy already visible in `inittab`.\n\n---\n\n## Impact\n\nUnauthenticated interactive root on the serial console. An attacker with PCB access can dump flash, credentials, and keys. Physical access is required (`AV:P`).\n\n---\n\n## Remediation\n\nRemove `-n root` from `/etc/inittab`. Require a login prompt, or disable the serial console in production builds.\n\n---\n\n## Timeline\n\n| Date | Event |\n| --- | --- |\n| 2026-09-09 | Static confirmation on V5.00.R02.20210818 |\n| 2026-09-09 | CVE ID requested from MITRE CNA-LR |\n\nVendor contact: not a prerequisite for this request. Hangzhou Xiongmai Technology Co., Ltd. is not a CVE CNA.\n", "creation_timestamp": "2026-09-09T15:32:43.127902Z"}