cve-2017-8226

{
  "advisories": [
    {
      "id": "EUVD-2017-17188",
      "source": "euvd",
      "title": "Amcrest IPM-721S V2.420.AC00.16.R.20160909 devices have default credentials that are hardcoded in the firmware and can be extracted by anyone who reverses the firmware to identify them. If the firmware version V2.420.AC00.16.R 9/9/2016 is dissected using binwalk tool, one obtains a _user-x.squashfs.img.extracted archive which contains the filesystem set up on the device that many of the binaries in the /usr folder. The binary \"sonia\" is the one that has the vulnerable function that sets up the default credentials on the device. If one opens this binary in IDA-pro, one will notice that this follows a ARM little endian format. The function sub_3DB2FC in IDA pro is identified to be setting up the values at address 0x003DB5A6. The sub_5C057C then sets this value and adds it to the Configuration files in /mnt/mtd/Config/Account1 file.",
      "url": "https://euvd.enisa.europa.eu/vulnerability/EUVD-2017-17188"
    }
  ],
  "cve": "CVE-2017-8226",
  "epss": {
    "score": 0.03799
  },
  "mitre": {
    "cpes": [],
    "created": "2019-07-03T19:25:16+00:00",
    "description": "Amcrest IPM-721S V2.420.AC00.16.R.20160909 devices have default credentials that are hardcoded in the firmware and can be extracted by anyone who reverses the firmware to identify them. If the firmware version V2.420.AC00.16.R 9/9/2016 is dissected using binwalk tool, one obtains a _user-x.squashfs.img.extracted archive which contains the filesystem set up on the device that many of the binaries in the /usr folder. The binary \"sonia\" is the one that has the vulnerable function that sets up the default credentials on the device. If one opens this binary in IDA-pro, one will notice that this follows a ARM little endian format. The function sub_3DB2FC in IDA pro is identified to be setting up the values at address 0x003DB5A6. The sub_5C057C then sets this value and adds it to the Configuration files in /mnt/mtd/Config/Account1 file.",
    "metrics": {
      "cvssV2_0": {},
      "cvssV3_0": {},
      "cvssV3_1": {},
      "cvssV4_0": {}
    },
    "mitre_repo_path": "cves/2017/8xxx/CVE-2017-8226.json",
    "references": [
      "http://packetstormsecurity.com/files/153224/Amcrest-IPM-721S-Credential-Disclosure-Privilege-Escalation.html",
      "https://github.com/ethanhunnt/IoT_vulnerabilities/blob/master/Amcrest_sec_issues.pdf",
      "https://seclists.org/bugtraq/2019/Jun/8"
    ],
    "title": null,
    "updated": "2024-08-05T16:27:23.251000+00:00",
    "vendors": [],
    "weaknesses": []
  },
  "nvd": {
    "cpes": [
      "cpe:2.3:h:amcrest:ipm-721s:-:*:*:*:*:*:*:*",
      "cpe:2.3:o:amcrest:ipm-721s_firmware:*:*:*:*:*:*:*:*"
    ],
    "created": "2019-07-03T20:15:10.430000+00:00",
    "description": "Amcrest IPM-721S V2.420.AC00.16.R.20160909 devices have default credentials that are hardcoded in the firmware and can be extracted by anyone who reverses the firmware to identify them. If the firmware version V2.420.AC00.16.R 9/9/2016 is dissected using binwalk tool, one obtains a _user-x.squashfs.img.extracted archive which contains the filesystem set up on the device that many of the binaries in the /usr folder. The binary \"sonia\" is the one that has the vulnerable function that sets up the default credentials on the device. If one opens this binary in IDA-pro, one will notice that this follows a ARM little endian format. The function sub_3DB2FC in IDA pro is identified to be setting up the values at address 0x003DB5A6. The sub_5C057C then sets this value and adds it to the Configuration files in /mnt/mtd/Config/Account1 file.",
    "metrics": {
      "cvssV2_0": {
        "score": 7.5,
        "vector": "AV:N/AC:L/Au:N/C:P/I:P/A:P"
      },
      "cvssV3_0": {
        "score": 9.8,
        "vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
      },
      "cvssV3_1": {},
      "cvssV4_0": {}
    },
    "nvd_repo_path": "2017/CVE-2017-8226.json",
    "references": [
      "http://packetstormsecurity.com/files/153224/Amcrest-IPM-721S-Credential-Disclosure-Privilege-Escalation.html",
      "https://github.com/ethanhunnt/IoT_vulnerabilities/blob/master/Amcrest_sec_issues.pdf",
      "https://seclists.org/bugtraq/2019/Jun/8"
    ],
    "title": null,
    "updated": "2026-06-17T01:26:00.430000+00:00",
    "vendors": [
      "amcrest",
      "amcrest$PRODUCT$ipm-721s",
      "amcrest$PRODUCT$ipm-721s_firmware"
    ],
    "weaknesses": [
      "CWE-798"
    ]
  },
  "opencve": {
    "changes": [],
    "cpes": {
      "data": [
        "cpe:2.3:h:amcrest:ipm-721s:-:*:*:*:*:*:*:*",
        "cpe:2.3:o:amcrest:ipm-721s_firmware:*:*:*:*:*:*:*:*"
      ],
      "providers": [
        "nvd"
      ]
    },
    "created": {
      "data": "2019-07-03T19:25:16+00:00",
      "provider": "mitre"
    },
    "description": {
      "data": "Amcrest IPM-721S V2.420.AC00.16.R.20160909 devices have default credentials that are hardcoded in the firmware and can be extracted by anyone who reverses the firmware to identify them. If the firmware version V2.420.AC00.16.R 9/9/2016 is dissected using binwalk tool, one obtains a _user-x.squashfs.img.extracted archive which contains the filesystem set up on the device that many of the binaries in the /usr folder. The binary \"sonia\" is the one that has the vulnerable function that sets up the default credentials on the device. If one opens this binary in IDA-pro, one will notice that this follows a ARM little endian format. The function sub_3DB2FC in IDA pro is identified to be setting up the values at address 0x003DB5A6. The sub_5C057C then sets this value and adds it to the Configuration files in /mnt/mtd/Config/Account1 file.",
      "provider": "mitre"
    },
    "metrics": {
      "cvssV2_0": {
        "data": {
          "score": 7.5,
          "vector": "AV:N/AC:L/Au:N/C:P/I:P/A:P"
        },
        "provider": "nvd"
      },
      "cvssV3_0": {
        "data": {
          "score": 9.8,
          "vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
        },
        "provider": "nvd"
      },
      "cvssV3_1": {
        "data": {},
        "provider": null
      },
      "cvssV4_0": {
        "data": {},
        "provider": null
      },
      "epss": {
        "data": {
          "score": 0.03799
        },
        "provider": "first"
      },
      "kev": {
        "data": {},
        "provider": null
      },
      "ssvc": {
        "data": {},
        "provider": null
      },
      "threat_severity": {
        "data": null,
        "provider": null
      }
    },
    "references": {
      "data": [
        "http://packetstormsecurity.com/files/153224/Amcrest-IPM-721S-Credential-Disclosure-Privilege-Escalation.html",
        "https://github.com/ethanhunnt/IoT_vulnerabilities/blob/master/Amcrest_sec_issues.pdf",
        "https://seclists.org/bugtraq/2019/Jun/8"
      ],
      "providers": [
        "mitre",
        "nvd"
      ]
    },
    "title": {
      "data": null,
      "provider": null
    },
    "updated": {
      "data": "2024-11-21T03:33:34.810000+00:00",
      "provider": "nvd"
    },
    "vendors": {
      "data": [
        "amcrest",
        "amcrest$PRODUCT$ipm-721s",
        "amcrest$PRODUCT$ipm-721s_firmware"
      ],
      "providers": [
        "nvd"
      ]
    },
    "weaknesses": {
      "data": [
        "CWE-798"
      ],
      "providers": [
        "nvd"
      ]
    }
  }
}