CVE-2017-8228

{"id": "CVE-2017-8228", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 6.8, "accessVector": "NETWORK", "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "MEDIUM", "availabilityImpact": "PARTIAL", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 6.4, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 8.6, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": true}], "cvssMetricV30": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.0", "baseScore": 8.8, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 2.8}]}, "published": "2019-07-03T20:15:10.573", "references": [{"url": "http://packetstormsecurity.com/files/153224/Amcrest-IPM-721S-Credential-Disclosure-Privilege-Escalation.html", "tags": ["Third Party Advisory", "VDB Entry"], "source": "cve@mitre.org"}, {"url": "https://github.com/ethanhunnt/IoT_vulnerabilities/blob/master/Amcrest_sec_issues.pdf", "tags": ["Exploit", "Third Party Advisory"], "source": "cve@mitre.org"}, {"url": "https://seclists.org/bugtraq/2019/Jun/8", "tags": ["Mailing List", "Third Party Advisory"], "source": "cve@mitre.org"}, {"url": "http://packetstormsecurity.com/files/153224/Amcrest-IPM-721S-Credential-Disclosure-Privilege-Escalation.html", "tags": ["Third Party Advisory", "VDB Entry"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://github.com/ethanhunnt/IoT_vulnerabilities/blob/master/Amcrest_sec_issues.pdf", "tags": ["Exploit", "Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://seclists.org/bugtraq/2019/Jun/8", "tags": ["Mailing List", "Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-264"}]}], "descriptions": [{"lang": "en", "value": "Amcrest IPM-721S V2.420.AC00.16.R.20160909 devices mishandle reboots within the past two hours. Amcrest cloud services does not perform a thorough verification when allowing the user to add a new camera to the user's account to ensure that the user actually owns the camera other than knowing the serial number of the camera. This can allow an attacker who knows the serial number to easily add another user's camera to an attacker's cloud account and control it completely. This is possible in case of any camera that is currently not a part of an Amcrest cloud account or has been removed from the user's cloud account. Also, another requirement for a successful attack is that the user should have rebooted the camera in the last two hours. However, both of these conditions are very likely for new cameras that are sold over the Internet at many ecommerce websites or vendors that sell the Amcrest products. The successful attack results in an attacker being able to completely control the camera which includes being able to view and listen on what the camera can see, being able to change the motion detection settings and also be able to turn the camera off without the user being aware of it. Note: The same attack can be executed using the Amcrest Cloud mobile application."}, {"lang": "es", "value": "Los dispositivos Amcrest IPM-721S V2.420.AC00.16.R.20160909 no se manejan correctamente durante las \u00faltimas dos horas. Los servicios en la nube de Amcrest no realizan una verificaci\u00f3n exhaustiva cuando permiten que el usuario agregue una nueva c\u00e1mara a la cuenta del usuario para garantizar que el usuario sea el propietario de la c\u00e1mara, aparte de saber el n\u00famero de serie de la c\u00e1mara. Esto puede permitir que un atacante que conoce el n\u00famero de serie agregue f\u00e1cilmente la c\u00e1mara de otro usuario a la cuenta de la nube de un atacante y la controle completamente. Esto es posible en el caso de que cualquier c\u00e1mara que actualmente no sea parte de una cuenta en la nube de Amcrest o haya sido eliminada de la cuenta en la nube del usuario. Adem\u00e1s, otro requisito para un ataque exitoso es que el usuario deber\u00eda haber reiniciado la c\u00e1mara en las \u00faltimas dos horas. Sin embargo, ambas condiciones son muy probables para las nuevas c\u00e1maras que se venden a trav\u00e9s de Internet en muchos sitios web de comercio electr\u00f3nico o proveedores que venden los productos Amcrest. El ataque con \u00e9xito hace que un atacante pueda controlar completamente la c\u00e1mara, lo que incluye poder ver y escuchar lo que la c\u00e1mara puede ver, poder cambiar la configuraci\u00f3n de detecci\u00f3n de movimiento y tambi\u00e9n poder apagar la c\u00e1mara sin que el usuario est\u00e9 consciente de ello. Nota: El mismo ataque se puede ejecutar utilizando la aplicaci\u00f3n m\u00f3vil Amcrest Cloud."}], "lastModified": "2024-11-21T03:33:35.130", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:amcrest:ipm-721s_firmware:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "2EC72AB3-67BC-4187-8918-8030B045F383", "versionEndIncluding": "2.420.ac00.16.r.20160909"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:amcrest:ipm-721s:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "A8A354BD-B8FC-45D1-B8B2-5A44334CF2F8"}], "operator": "OR"}], "operator": "AND"}], "sourceIdentifier": "cve@mitre.org"}