{"vulnerability": "CVE-2021-4150", "sightings": [{"uuid": "fc5c070f-1562-4b1b-9abe-cb8d8d1aa4b4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-41506", "type": "seen", "source": "https://t.me/cibsecurity/45409", "content": "\u203c CVE-2021-41506 \u203c\n\nXiaongmai AHB7008T-MH-V2, AHB7804R-ELS, AHB7804R-MH-V2, AHB7808R-MS-V2, AHB7808R-MS, AHB7808T-MS-V2, AHB7804R-LMS, HI3518_50H10L_S39 V4.02.R11.7601.Nat.Onvif.20170420, V4.02.R11.Nat.Onvif.20160422, V4.02.R11.7601.Nat.Onvif.20170424, V4.02.R11.Nat.Onvif.20170327, V4.02.R11.Nat.Onvif.20161205, V4.02.R11.Nat.20170301, V4.02.R12.Nat.OnvifS.20170727 is affected by a backdoor in the macGuarder and dvrHelper binaries of DVR/NVR/IP camera firmware due to static root account credentials in the system.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2022-06-30T16:38:39.000000Z"}, {"uuid": "f779ec74-9970-4109-9272-4ad4bf8e4dd4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-4150", "type": "seen", "source": "https://t.me/cibsecurity/39447", "content": "\u203c CVE-2021-4150 \u203c\n\nA use-after-free flaw was found in the add_partition in block/partitions/core.c in the Linux kernel. A local attacker with user privileges could cause a denial of service on the system. The issue results from the lack of code cleanup when device_add call fails when adding a partition to the disk.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2022-03-23T23:29:04.000000Z"}, {"uuid": "e80bd205-9a28-438a-abb7-120d868c0096", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-41500", "type": "seen", "source": "https://t.me/cibsecurity/34238", "content": "\u203c CVE-2021-41500 \u203c\n\nIncomplete string comparison vulnerability exits in cvxopt.org cvxop <= 1.2.6 in APIs (cvxopt.cholmod.diag, cvxopt.cholmod.getfactor, cvxopt.cholmod.solve, cvxopt.cholmod.spsolve), which allows attackers to conduct Denial of Service attacks by construct fake Capsule objects.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2021-12-18T00:37:47.000000Z"}, {"uuid": "5741c8bd-558d-42a6-bcd3-e2cb60a1ccf6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-41503", "type": "seen", "source": "https://t.me/cibsecurity/29406", "content": "\u203c CVE-2021-41503 \u203c\n\n** UNSUPPORTED WHEN ASSIGNED ** DCS-5000L v1.05 and DCS-932L v2.17 and older are affecged by Incorrect Acess Control. The use of the basic authentication for the devices command interface allows attack vectors that may compromise the cameras configuration and allow malicious users on the LAN to access the device. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2021-09-25T00:31:06.000000Z"}, {"uuid": "d30f8a38-eadd-411e-8dc2-9ffaa17eaa7c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-41504", "type": "seen", "source": "https://t.me/cibsecurity/29411", "content": "\u203c CVE-2021-41504 \u203c\n\n** UNSUPPORTED WHEN ASSIGNED ** An Elevated Privileges issue exists in D-Link DCS-5000L v1.05 and DCS-932L v2.17 and older. The use of the digest-authentication for the devices command interface may allow further attack vectors that may compromise the cameras configuration and allow malicious users on the LAN to access the device. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2021-09-25T00:31:13.000000Z"}, {"uuid": "d9cafd20-5cd8-4d31-8539-c846e8d9f1d5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-41506", "type": "seen", "source": "https://gist.github.com/TheFury4/e0e26152e645a7617d2f71d377a37f04", "content": "# Xiongmai XM530: unsigned MicroSD script executed as root (`sd_run.sh`)\n\n| Field | Value |\n| --- | --- |\n| Vendor | Hangzhou Xiongmai Technology Co., Ltd. |\n| Product | XM530 IP Camera firmware (OEM / white-label) |\n| Hardware | XM530_R80X20-PQ_8M |\n| Version | V5.00.R02.20210818 |\n| Request tracking | CAN-2026-2037297 |\n| CVE | Reserved / pending MITRE CNA-LR |\n| CWE | CWE-94, CWE-306 |\n| CVSS v3.1 | 6.8 (`AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H`) |\n| CVSS v4.0 | 7.0 (`AV:P/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N`) |\n| Attack vector | Physical (MicroSD slot) |\n| Discovery | External, offline static analysis |\n| Date | 9 September 2026 |\n| Finder | emanu066@gmail.com |\n\nThis advisory is self-contained. A reviewer can confirm the defect against the official firmware image using the hashes and extracts below. No live camera, network traffic, or exploit payload is required.\n\n---\n\n## Summary\n\nThe helper daemon `/usr/bin/dvrHelper` (squashfs path `/bin/dvrHelper`) automatically executes `/home/sd_run.sh` as root when a FAT volume is mounted from the camera MicroSD slot. There is no authentication, digital signature, or integrity check on that script.\n\n---\n\n## Affected image\n\n| Item | Value |\n| --- | --- |\n| Filename | `General_IPC_XM530_R80X20-PQ_WIFIXM711.711.Nat.dss.OnvifS_V5.00.R02.20210818_all.bin` |\n| Size | 6,784,000 bytes |\n| SHA-256 | `d75262b6dfef74144fda52234df273963bdc6001133bd5e8aab570a6de4e16b8` |\n| MD5 | `1443425028aa074ad9e0370830cb82e3` |\n| Device ID | `000306951001000000600000` |\n| `dvrHelper` SHA-256 | `40c7043b1c68029508b173ec099c90f53110af6c3752243a2404a3e9fe95c0a8` |\n| `dvrHelper` size | 18,256 bytes |\n\nThe `.bin` is a ZIP of MTD partition images. `dvrHelper` lives in `user-x.cramfs.img` (SquashFS), mounted at `/usr` at runtime.\n\nOther XM530 OEM builds that ship the same `dvrHelper` `sub_AF28` logic may be affected. That was not surveyed.\n\n---\n\n## Description\n\n`/etc/init.d/rcS` starts `dvrHelper` as root. In `sub_AF28` the process:\n\n1. Polls `/dev/mmcblk0p1`, then `/dev/mmcblk0`.\n2. Mounts the volume as `vfat` on `/home`.\n3. If `/home/sd_upgrade_all.bin` is absent, checks `/home/sd_run.sh`.\n4. If the script exists: `system(\"rmmod xm_wdt\")`, then  \n   `execl(\"/bin/sh\", \"sh\", \"/home/sd_run.sh\", NULL)`.\n\nA physically present attacker who can insert a MicroSD card containing a file named `sd_run.sh` obtains a root shell interpreter. No password, UART, or network access is required.\n\nThis is distinct from the well-known factory hash `xmhdipc` (CVE-2021-41506) and from the TCP/9530 OpenTelnet issue (CVE-2020-22253).\n\n---\n\n## Evidence from this image\n\n### 1. Process start (root)\n\nFile: cramfs `romfs-x.cramfs.img` \u2192 `/etc/init.d/rcS`\n\n```text\ndvrHelper /lib/modules /usr/bin/app.sh 127.0.0.1 9578 1 &\n```\n\n### 2. Removable-media mount\n\nFile: squashfs `user-x.cramfs.img` \u2192 `/bin/dvrHelper`  \nFunction: `sub_AF28` (IDA ARM listing, file offsets)\n\n```text\n0x0000B07C  LDR   R8, =(aDevMmcblk0p1 - 0xB084) ; \"/dev/mmcblk0p1\"\n0x0000B080  LDR   R9, =(aDevMmcblk0 - 0xB088)   ; \"/dev/mmcblk0\"\n...\n0x0000B090  MOV   R0, R8                         ; name\n0x0000B094  MOV   R1, #0                         ; F_OK\n0x0000B098  BL    access\n...\n0x0000B0A8  LDR   R1, =(aHome - 0xB0B4)          ; \"/home\"\n0x0000B0AC  LDR   R2, =(aVfat - 0xB0BC)          ; \"vfat\"\n...\n0x0000B0E8  MOV   R3, #4                         ; MS_SYNCHRONOUS\n0x0000B0EC  BL    mount\n```\n\n### 3. Unsigned script execution (`loc_B218`)\n\n```text\n0x0000B218 loc_B218:\n0x0000B218   LDR   R4, =(aHomeSdRunSh - 0xB228) ; \"/home/sd_run.sh\"\n0x0000B224   MOV   R0, R4                       ; name\n0x0000B228   BL    access                       ; access(path, F_OK)\n0x0000B22C   SUBS  R8, R0, #0\n0x0000B230   BNE   loc_B274\n0x0000B234   LDR   R0, =(aRmmodXmWdt - 0xB240)  ; \"rmmod xm_wdt\"\n0x0000B23C   BL    system\n0x0000B248   LDR   R0, =(aRunSdRunSh - 0xB254)  ; \"run sd_run.sh!\"\n0x0000B250   BL    printf\n0x0000B254   LDR   R0, =(aBinSh - 0xB26C)       ; \"/bin/sh\"\n0x0000B258   LDR   R1, =(aHomeSdRunSh+0xD)      ; \"sh\"\n0x0000B25C   MOV   R2, R4                       ; \"/home/sd_run.sh\"\n0x0000B260   MOV   R3, R8                       ; NULL\n0x0000B26C   BL    execl                        ; execl(\"/bin/sh\", \"sh\", \"/home/sd_run.sh\", NULL)\n```\n\nBetween `access(\"/home/sd_run.sh\")` and `execl` there is no signature, HMAC, or confirmation path.\n\n### 4. `.rodata` strings in the same binary\n\n```text\naDevMmcblk0p1    \"/dev/mmcblk0p1\"\naDevMmcblk0      \"/dev/mmcblk0\"\naHome            \"/home\"\naVfat            \"vfat\"\naHomeSdRunSh     \"/home/sd_run.sh\"\naRmmodXmWdt      \"rmmod xm_wdt\"\naRunSdRunSh      \"run sd_run.sh!\"\naBinSh           \"/bin/sh\"\n```\n\nConfirm with:\n\n```text\nstrings dvrHelper | grep -E 'sd_run|mmcblk0|rmmod xm_wdt'\n```\n\nExpected hits include `/home/sd_run.sh` and `run sd_run.sh!`.\n\n---\n\n## How a reviewer verifies this (no device needed)\n\n1. Hash the ZIP/firmware blob; it must match  \n   `d75262b6dfef74144fda52234df273963bdc6001133bd5e8aab570a6de4e16b8`.\n2. Unzip; extract `user-x.cramfs.img` (SquashFS) and `romfs-x.cramfs.img` (CramFS).\n3. Confirm `/etc/init.d/rcS` contains the `dvrHelper ... 9578 1` line.\n4. Hash `bin/dvrHelper`; it must match  \n   `40c7043b1c68029508b173ec099c90f53110af6c3752243a2404a3e9fe95c0a8`.\n5. `strings` / disassemble `dvrHelper` and match `loc_B218` above.\n\nThat is sufficient to establish the vulnerability. A camera is not required.\n\n---\n\n## Impact\n\nRoot code execution from the external SD slot. The same function can also invoke `/var/upgrader` on `/home/sd_upgrade_all.bin` if that file is present; that path is out of scope for this CVE request.\n\n---\n\n## Remediation\n\nRemove automatic execution of `/home/sd_run.sh` from production firmware. If factory tooling still needs an SD hook, require an asymmetric signature over the script and fail closed.\n\n---\n\n## Timeline\n\n| Date | Event |\n| --- | --- |\n| 2026-09-09 | Static confirmation on V5.00.R02.20210818 |\n| 2026-09-09 | CVE ID requested from MITRE CNA-LR (CAN-2026-2037297) |\n\nVendor contact: not a prerequisite for this request. Hangzhou Xiongmai Technology Co., Ltd. is not a CVE CNA.\n", "creation_timestamp": "2026-09-09T15:26:45.259669Z"}, {"uuid": "8e63d42b-bf87-40b1-85a0-691b1df71919", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-41506", "type": "seen", "source": "https://gist.github.com/TheFury4/370c01a013f8a1d3af34a5adcae1c67b", "content": "# Xiongmai XM530: UART console auto-login as root\n\n| Field | Value |\n| --- | --- |\n| Vendor | Hangzhou Xiongmai Technology Co., Ltd. |\n| Product | XM530 IP Camera firmware (OEM / white-label) |\n| Hardware | XM530_R80X20-PQ_8M |\n| Version | V5.00.R02.20210818 |\n| Request tracking | (second CAN \u2014 paste the CAN-2026-* assigned by the portal) |\n| CVE | Reserved / pending MITRE CNA-LR |\n| CWE | CWE-306 |\n| CVSS v3.1 | 6.8 (`AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H`) |\n| CVSS v4.0 | 7.0 (`AV:P/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N`) |\n| Attack vector | Physical (UART / `ttyS000`, 115200 8N1) |\n| Discovery | External, offline static analysis |\n| Date | 9 September 2026 |\n| Finder | emanu066@gmail.com |\n\nThis advisory is self-contained. A reviewer can confirm the defect against the official firmware image using the hashes and extracts below. No live camera or exploit payload is required.\n\n---\n\n## Summary\n\nBusyBox init starts `getty` on the serial console with `-n root`, which skips authentication and drops to an interactive root shell. Physical access to the UART pads is sufficient.\n\n---\n\n## Affected image\n\n| Item | Value |\n| --- | --- |\n| Filename | `General_IPC_XM530_R80X20-PQ_WIFIXM711.711.Nat.dss.OnvifS_V5.00.R02.20210818_all.bin` |\n| Size | 6,784,000 bytes |\n| SHA-256 | `d75262b6dfef74144fda52234df273963bdc6001133bd5e8aab570a6de4e16b8` |\n| MD5 | `1443425028aa074ad9e0370830cb82e3` |\n| Device ID | `000306951001000000600000` |\n| Partition | `romfs-x.cramfs.img` (CramFS, SHA-256 `e5a956ae8e1f572da9ea0355410639d6b2fe170bc0e93237ebc0b05b634887fc`) |\n| Config file | `/etc/inittab` |\n\nOther XM530 OEM builds that ship the same `getty -n root` line may be affected. That was not surveyed.\n\n---\n\n## Description\n\n`/etc/inittab` contains:\n\n```text\n::respawn:/sbin/getty -L ttyS000 115200 vt100 -n root -I \"Auto login as root ...\"\n```\n\nBusyBox `getty -n USER` does not prompt for a password. The console is also selected in the U-Boot environment (`console=ttyAMA0,115200`). A physically present attacker with a 3.3 V UART adapter on `ttyS000` / `ttyAMA0` at 115200 8N1 obtains a root shell without credentials.\n\nThis is independent of `/etc/passwd`. Auto-login does not consult the `xmhdipc` hash. That factory password is already tracked as **CVE-2021-41506** and is **not** this vulnerability.\n\n---\n\n## Evidence from this image\n\n### 1. Complete `/etc/inittab`\n\nFile: cramfs `romfs-x.cramfs.img` \u2192 `/etc/inittab`\n\n```text\n::sysinit:/etc/init.d/rcS\n#::askfirst:/bin/sh\n\n::respawn:/sbin/getty -L ttyS000 115200 vt100 -n root -I \"Auto login as root ...\"\n\n::ctrlaltdel:/sbin/reboot\n::shutdown:/bin/umount -a -r\n::restart:/sbin/init\n```\n\nThe usual interactive line `#::askfirst:/bin/sh` is commented out. The live `getty` line is the one with `-n root`.\n\nBusyBox documentation: `-n` skip login; the following argument is the username. Here that username is `root`.\n\n### 2. Kernel console in U-Boot environment\n\nFile: `u-boot.env.img`\n\n```text\nbootargs=mem=35M console=ttyAMA0,115200 root=/dev/mtdblock2 rootfstype=cramfs mtdparts=xm_sfc:256K(boot),1536K(kernel),1280K(romfs),4544K(user),256K(custom),320K(mtd)\n```\n\n### 3. Not this CVE (recorded only to prevent mix-up)\n\nFile: `/etc/passwd`\n\n```text\nroot:$1$RYIwEiRA$d5iRRVQ5ZeRTrJwGjRy.B0:0:0:root:/:/bin/sh\n```\n\n`openssl passwd -1 -salt RYIwEiRA xmhdipc` reproduces that hash. That is CVE-2021-41506. Do not merge it into this ID.\n\n---\n\n## How a reviewer verifies this (no device needed)\n\n1. Hash the firmware blob; it must match  \n   `d75262b6dfef74144fda52234df273963bdc6001133bd5e8aab570a6de4e16b8`.\n2. Unzip; extract `romfs-x.cramfs.img`.\n3. Read `/etc/inittab`. The `getty` line must contain `-n root`.\n4. Optionally extract strings from `u-boot.env.img` and confirm `console=ttyAMA0,115200`.\n\nThat is sufficient. Attaching a UART cable to hardware only reproduces the same init policy already visible in `inittab`.\n\n---\n\n## Impact\n\nUnauthenticated interactive root on the serial console. An attacker with PCB access can dump flash, credentials, and keys. Physical access is required (`AV:P`).\n\n---\n\n## Remediation\n\nRemove `-n root` from `/etc/inittab`. Require a login prompt, or disable the serial console in production builds.\n\n---\n\n## Timeline\n\n| Date | Event |\n| --- | --- |\n| 2026-09-09 | Static confirmation on V5.00.R02.20210818 |\n| 2026-09-09 | CVE ID requested from MITRE CNA-LR |\n\nVendor contact: not a prerequisite for this request. Hangzhou Xiongmai Technology Co., Ltd. is not a CVE CNA.\n", "creation_timestamp": "2026-09-09T15:32:43.127902Z"}]}