{"vulnerability": "CVE-2021-41506", "sightings": [{"uuid": "fc5c070f-1562-4b1b-9abe-cb8d8d1aa4b4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-41506", "type": "seen", "source": "https://t.me/cibsecurity/45409", "content": "\u203c CVE-2021-41506 \u203c\n\nXiaongmai AHB7008T-MH-V2, AHB7804R-ELS, AHB7804R-MH-V2, AHB7808R-MS-V2, AHB7808R-MS, AHB7808T-MS-V2, AHB7804R-LMS, HI3518_50H10L_S39 V4.02.R11.7601.Nat.Onvif.20170420, V4.02.R11.Nat.Onvif.20160422, V4.02.R11.7601.Nat.Onvif.20170424, V4.02.R11.Nat.Onvif.20170327, V4.02.R11.Nat.Onvif.20161205, V4.02.R11.Nat.20170301, V4.02.R12.Nat.OnvifS.20170727 is affected by a backdoor in the macGuarder and dvrHelper binaries of DVR/NVR/IP camera firmware due to static root account credentials in the system.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2022-06-30T16:38:39.000000Z"}, {"uuid": "d9cafd20-5cd8-4d31-8539-c846e8d9f1d5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-41506", "type": "seen", "source": "https://gist.github.com/TheFury4/e0e26152e645a7617d2f71d377a37f04", "content": "# Xiongmai XM530: unsigned MicroSD script executed as root (`sd_run.sh`)\n\n| Field | Value |\n| --- | --- |\n| Vendor | Hangzhou Xiongmai Technology Co., Ltd. |\n| Product | XM530 IP Camera firmware (OEM / white-label) |\n| Hardware | XM530_R80X20-PQ_8M |\n| Version | V5.00.R02.20210818 |\n| Request tracking | CAN-2026-2037297 |\n| CVE | Reserved / pending MITRE CNA-LR |\n| CWE | CWE-94, CWE-306 |\n| CVSS v3.1 | 6.8 (`AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H`) |\n| CVSS v4.0 | 7.0 (`AV:P/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N`) |\n| Attack vector | Physical (MicroSD slot) |\n| Discovery | External, offline static analysis |\n| Date | 9 September 2026 |\n| Finder | emanu066@gmail.com |\n\nThis advisory is self-contained. A reviewer can confirm the defect against the official firmware image using the hashes and extracts below. No live camera, network traffic, or exploit payload is required.\n\n---\n\n## Summary\n\nThe helper daemon `/usr/bin/dvrHelper` (squashfs path `/bin/dvrHelper`) automatically executes `/home/sd_run.sh` as root when a FAT volume is mounted from the camera MicroSD slot. There is no authentication, digital signature, or integrity check on that script.\n\n---\n\n## Affected image\n\n| Item | Value |\n| --- | --- |\n| Filename | `General_IPC_XM530_R80X20-PQ_WIFIXM711.711.Nat.dss.OnvifS_V5.00.R02.20210818_all.bin` |\n| Size | 6,784,000 bytes |\n| SHA-256 | `d75262b6dfef74144fda52234df273963bdc6001133bd5e8aab570a6de4e16b8` |\n| MD5 | `1443425028aa074ad9e0370830cb82e3` |\n| Device ID | `000306951001000000600000` |\n| `dvrHelper` SHA-256 | `40c7043b1c68029508b173ec099c90f53110af6c3752243a2404a3e9fe95c0a8` |\n| `dvrHelper` size | 18,256 bytes |\n\nThe `.bin` is a ZIP of MTD partition images. `dvrHelper` lives in `user-x.cramfs.img` (SquashFS), mounted at `/usr` at runtime.\n\nOther XM530 OEM builds that ship the same `dvrHelper` `sub_AF28` logic may be affected. That was not surveyed.\n\n---\n\n## Description\n\n`/etc/init.d/rcS` starts `dvrHelper` as root. In `sub_AF28` the process:\n\n1. Polls `/dev/mmcblk0p1`, then `/dev/mmcblk0`.\n2. Mounts the volume as `vfat` on `/home`.\n3. If `/home/sd_upgrade_all.bin` is absent, checks `/home/sd_run.sh`.\n4. If the script exists: `system(\"rmmod xm_wdt\")`, then  \n   `execl(\"/bin/sh\", \"sh\", \"/home/sd_run.sh\", NULL)`.\n\nA physically present attacker who can insert a MicroSD card containing a file named `sd_run.sh` obtains a root shell interpreter. No password, UART, or network access is required.\n\nThis is distinct from the well-known factory hash `xmhdipc` (CVE-2021-41506) and from the TCP/9530 OpenTelnet issue (CVE-2020-22253).\n\n---\n\n## Evidence from this image\n\n### 1. Process start (root)\n\nFile: cramfs `romfs-x.cramfs.img` \u2192 `/etc/init.d/rcS`\n\n```text\ndvrHelper /lib/modules /usr/bin/app.sh 127.0.0.1 9578 1 &\n```\n\n### 2. Removable-media mount\n\nFile: squashfs `user-x.cramfs.img` \u2192 `/bin/dvrHelper`  \nFunction: `sub_AF28` (IDA ARM listing, file offsets)\n\n```text\n0x0000B07C  LDR   R8, =(aDevMmcblk0p1 - 0xB084) ; \"/dev/mmcblk0p1\"\n0x0000B080  LDR   R9, =(aDevMmcblk0 - 0xB088)   ; \"/dev/mmcblk0\"\n...\n0x0000B090  MOV   R0, R8                         ; name\n0x0000B094  MOV   R1, #0                         ; F_OK\n0x0000B098  BL    access\n...\n0x0000B0A8  LDR   R1, =(aHome - 0xB0B4)          ; \"/home\"\n0x0000B0AC  LDR   R2, =(aVfat - 0xB0BC)          ; \"vfat\"\n...\n0x0000B0E8  MOV   R3, #4                         ; MS_SYNCHRONOUS\n0x0000B0EC  BL    mount\n```\n\n### 3. Unsigned script execution (`loc_B218`)\n\n```text\n0x0000B218 loc_B218:\n0x0000B218   LDR   R4, =(aHomeSdRunSh - 0xB228) ; \"/home/sd_run.sh\"\n0x0000B224   MOV   R0, R4                       ; name\n0x0000B228   BL    access                       ; access(path, F_OK)\n0x0000B22C   SUBS  R8, R0, #0\n0x0000B230   BNE   loc_B274\n0x0000B234   LDR   R0, =(aRmmodXmWdt - 0xB240)  ; \"rmmod xm_wdt\"\n0x0000B23C   BL    system\n0x0000B248   LDR   R0, =(aRunSdRunSh - 0xB254)  ; \"run sd_run.sh!\"\n0x0000B250   BL    printf\n0x0000B254   LDR   R0, =(aBinSh - 0xB26C)       ; \"/bin/sh\"\n0x0000B258   LDR   R1, =(aHomeSdRunSh+0xD)      ; \"sh\"\n0x0000B25C   MOV   R2, R4                       ; \"/home/sd_run.sh\"\n0x0000B260   MOV   R3, R8                       ; NULL\n0x0000B26C   BL    execl                        ; execl(\"/bin/sh\", \"sh\", \"/home/sd_run.sh\", NULL)\n```\n\nBetween `access(\"/home/sd_run.sh\")` and `execl` there is no signature, HMAC, or confirmation path.\n\n### 4. `.rodata` strings in the same binary\n\n```text\naDevMmcblk0p1    \"/dev/mmcblk0p1\"\naDevMmcblk0      \"/dev/mmcblk0\"\naHome            \"/home\"\naVfat            \"vfat\"\naHomeSdRunSh     \"/home/sd_run.sh\"\naRmmodXmWdt      \"rmmod xm_wdt\"\naRunSdRunSh      \"run sd_run.sh!\"\naBinSh           \"/bin/sh\"\n```\n\nConfirm with:\n\n```text\nstrings dvrHelper | grep -E 'sd_run|mmcblk0|rmmod xm_wdt'\n```\n\nExpected hits include `/home/sd_run.sh` and `run sd_run.sh!`.\n\n---\n\n## How a reviewer verifies this (no device needed)\n\n1. Hash the ZIP/firmware blob; it must match  \n   `d75262b6dfef74144fda52234df273963bdc6001133bd5e8aab570a6de4e16b8`.\n2. Unzip; extract `user-x.cramfs.img` (SquashFS) and `romfs-x.cramfs.img` (CramFS).\n3. Confirm `/etc/init.d/rcS` contains the `dvrHelper ... 9578 1` line.\n4. Hash `bin/dvrHelper`; it must match  \n   `40c7043b1c68029508b173ec099c90f53110af6c3752243a2404a3e9fe95c0a8`.\n5. `strings` / disassemble `dvrHelper` and match `loc_B218` above.\n\nThat is sufficient to establish the vulnerability. A camera is not required.\n\n---\n\n## Impact\n\nRoot code execution from the external SD slot. The same function can also invoke `/var/upgrader` on `/home/sd_upgrade_all.bin` if that file is present; that path is out of scope for this CVE request.\n\n---\n\n## Remediation\n\nRemove automatic execution of `/home/sd_run.sh` from production firmware. If factory tooling still needs an SD hook, require an asymmetric signature over the script and fail closed.\n\n---\n\n## Timeline\n\n| Date | Event |\n| --- | --- |\n| 2026-09-09 | Static confirmation on V5.00.R02.20210818 |\n| 2026-09-09 | CVE ID requested from MITRE CNA-LR (CAN-2026-2037297) |\n\nVendor contact: not a prerequisite for this request. Hangzhou Xiongmai Technology Co., Ltd. is not a CVE CNA.\n", "creation_timestamp": "2026-09-09T15:26:45.259669Z"}, {"uuid": "8e63d42b-bf87-40b1-85a0-691b1df71919", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-41506", "type": "seen", "source": "https://gist.github.com/TheFury4/370c01a013f8a1d3af34a5adcae1c67b", "content": "# Xiongmai XM530: UART console auto-login as root\n\n| Field | Value |\n| --- | --- |\n| Vendor | Hangzhou Xiongmai Technology Co., Ltd. |\n| Product | XM530 IP Camera firmware (OEM / white-label) |\n| Hardware | XM530_R80X20-PQ_8M |\n| Version | V5.00.R02.20210818 |\n| Request tracking | (second CAN \u2014 paste the CAN-2026-* assigned by the portal) |\n| CVE | Reserved / pending MITRE CNA-LR |\n| CWE | CWE-306 |\n| CVSS v3.1 | 6.8 (`AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H`) |\n| CVSS v4.0 | 7.0 (`AV:P/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N`) |\n| Attack vector | Physical (UART / `ttyS000`, 115200 8N1) |\n| Discovery | External, offline static analysis |\n| Date | 9 September 2026 |\n| Finder | emanu066@gmail.com |\n\nThis advisory is self-contained. A reviewer can confirm the defect against the official firmware image using the hashes and extracts below. No live camera or exploit payload is required.\n\n---\n\n## Summary\n\nBusyBox init starts `getty` on the serial console with `-n root`, which skips authentication and drops to an interactive root shell. Physical access to the UART pads is sufficient.\n\n---\n\n## Affected image\n\n| Item | Value |\n| --- | --- |\n| Filename | `General_IPC_XM530_R80X20-PQ_WIFIXM711.711.Nat.dss.OnvifS_V5.00.R02.20210818_all.bin` |\n| Size | 6,784,000 bytes |\n| SHA-256 | `d75262b6dfef74144fda52234df273963bdc6001133bd5e8aab570a6de4e16b8` |\n| MD5 | `1443425028aa074ad9e0370830cb82e3` |\n| Device ID | `000306951001000000600000` |\n| Partition | `romfs-x.cramfs.img` (CramFS, SHA-256 `e5a956ae8e1f572da9ea0355410639d6b2fe170bc0e93237ebc0b05b634887fc`) |\n| Config file | `/etc/inittab` |\n\nOther XM530 OEM builds that ship the same `getty -n root` line may be affected. That was not surveyed.\n\n---\n\n## Description\n\n`/etc/inittab` contains:\n\n```text\n::respawn:/sbin/getty -L ttyS000 115200 vt100 -n root -I \"Auto login as root ...\"\n```\n\nBusyBox `getty -n USER` does not prompt for a password. The console is also selected in the U-Boot environment (`console=ttyAMA0,115200`). A physically present attacker with a 3.3 V UART adapter on `ttyS000` / `ttyAMA0` at 115200 8N1 obtains a root shell without credentials.\n\nThis is independent of `/etc/passwd`. Auto-login does not consult the `xmhdipc` hash. That factory password is already tracked as **CVE-2021-41506** and is **not** this vulnerability.\n\n---\n\n## Evidence from this image\n\n### 1. Complete `/etc/inittab`\n\nFile: cramfs `romfs-x.cramfs.img` \u2192 `/etc/inittab`\n\n```text\n::sysinit:/etc/init.d/rcS\n#::askfirst:/bin/sh\n\n::respawn:/sbin/getty -L ttyS000 115200 vt100 -n root -I \"Auto login as root ...\"\n\n::ctrlaltdel:/sbin/reboot\n::shutdown:/bin/umount -a -r\n::restart:/sbin/init\n```\n\nThe usual interactive line `#::askfirst:/bin/sh` is commented out. The live `getty` line is the one with `-n root`.\n\nBusyBox documentation: `-n` skip login; the following argument is the username. Here that username is `root`.\n\n### 2. Kernel console in U-Boot environment\n\nFile: `u-boot.env.img`\n\n```text\nbootargs=mem=35M console=ttyAMA0,115200 root=/dev/mtdblock2 rootfstype=cramfs mtdparts=xm_sfc:256K(boot),1536K(kernel),1280K(romfs),4544K(user),256K(custom),320K(mtd)\n```\n\n### 3. Not this CVE (recorded only to prevent mix-up)\n\nFile: `/etc/passwd`\n\n```text\nroot:$1$RYIwEiRA$d5iRRVQ5ZeRTrJwGjRy.B0:0:0:root:/:/bin/sh\n```\n\n`openssl passwd -1 -salt RYIwEiRA xmhdipc` reproduces that hash. That is CVE-2021-41506. Do not merge it into this ID.\n\n---\n\n## How a reviewer verifies this (no device needed)\n\n1. Hash the firmware blob; it must match  \n   `d75262b6dfef74144fda52234df273963bdc6001133bd5e8aab570a6de4e16b8`.\n2. Unzip; extract `romfs-x.cramfs.img`.\n3. Read `/etc/inittab`. The `getty` line must contain `-n root`.\n4. Optionally extract strings from `u-boot.env.img` and confirm `console=ttyAMA0,115200`.\n\nThat is sufficient. Attaching a UART cable to hardware only reproduces the same init policy already visible in `inittab`.\n\n---\n\n## Impact\n\nUnauthenticated interactive root on the serial console. An attacker with PCB access can dump flash, credentials, and keys. Physical access is required (`AV:P`).\n\n---\n\n## Remediation\n\nRemove `-n root` from `/etc/inittab`. Require a login prompt, or disable the serial console in production builds.\n\n---\n\n## Timeline\n\n| Date | Event |\n| --- | --- |\n| 2026-09-09 | Static confirmation on V5.00.R02.20210818 |\n| 2026-09-09 | CVE ID requested from MITRE CNA-LR |\n\nVendor contact: not a prerequisite for this request. Hangzhou Xiongmai Technology Co., Ltd. is not a CVE CNA.\n", "creation_timestamp": "2026-09-09T15:32:43.127902Z"}]}