What is the severity of CVE-2017-8226?

The severity of CVE-2017-8226 is critical with a CVSS score of 9.8.

Which Amcrest devices are affected by CVE-2017-8226?

Amcrest IPM-721S V2.420.AC00.16.R.20160909 devices are affected by CVE-2017-8226.

What is the vulnerability description of CVE-2017-8226?

CVE-2017-8226 is a vulnerability in Amcrest IPM-721S V2.420.AC00.16.R.20160909 devices that have default credentials hardcoded in the firmware, which can be extracted by reversing the firmware.

How can the default credentials be obtained in Amcrest IPM-721S V2.420.AC00.16.R.20160909 devices?

The default credentials in Amcrest IPM-721S V2.420.AC00.16.R.20160909 devices can be obtained by reversing the firmware using a tool like binwalk.

Are all versions of Amcrest IPM-721S affected by CVE-2017-8226?

No, only the devices running firmware version V2.420.AC00.16.R 9/9/2016 are affected by CVE-2017-8226.

Vulnerability/
CVE-2017-8226

critical

9.8

CWE

798

3/7/2019

11/7/2019

CVE-2017-8226

First published: Wed Jul 03 2019(Updated: )

Amcrest IPM-721S V2.420.AC00.16.R.20160909 devices have default credentials that are hardcoded in the firmware and can be extracted by anyone who reverses the firmware to identify them. If the firmware version V2.420.AC00.16.R 9/9/2016 is dissected using binwalk tool, one obtains a _user-x.squashfs.img.extracted archive which contains the filesystem set up on the device that many of the binaries in the /usr folder. The binary "sonia" is the one that has the vulnerable function that sets up the default credentials on the device. If one opens this binary in IDA-pro, one will notice that this follows a ARM little endian format. The function sub_3DB2FC in IDA pro is identified to be setting up the values at address 0x003DB5A6. The sub_5C057C then sets this value and adds it to the Configuration files in /mnt/mtd/Config/Account1 file.

Credit: cve@mitre.org

Affected Software	Affected Version	How to fix
Amcrest Ipm-721s Firmware	<=2.420.ac00.16.r.20160909
Amcrest IPM-721S

Never miss a vulnerability like this again

Reference Links

Frequently Asked Questions

What is the severity of CVE-2017-8226?
The severity of CVE-2017-8226 is critical with a CVSS score of 9.8.
Which Amcrest devices are affected by CVE-2017-8226?
Amcrest IPM-721S V2.420.AC00.16.R.20160909 devices are affected by CVE-2017-8226.
What is the vulnerability description of CVE-2017-8226?
CVE-2017-8226 is a vulnerability in Amcrest IPM-721S V2.420.AC00.16.R.20160909 devices that have default credentials hardcoded in the firmware, which can be extracted by reversing the firmware.
How can the default credentials be obtained in Amcrest IPM-721S V2.420.AC00.16.R.20160909 devices?
The default credentials in Amcrest IPM-721S V2.420.AC00.16.R.20160909 devices can be obtained by reversing the firmware using a tool like binwalk.
Are all versions of Amcrest IPM-721S affected by CVE-2017-8226?
No, only the devices running firmware version V2.420.AC00.16.R 9/9/2016 are affected by CVE-2017-8226.

collector/nvd-index
vendor/amcrest
product/ipm-721s firmware
canonical/amcrest ipm-721s firmware
product/ipm-721s
canonical/amcrest ipm-721s

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co

By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.