CVE-2017-8226: Critical severity Amcrest Ipm-721s Firmware vulnerability
Amcrest IPM-721S V2.420.AC00.16.R.20160909 devices have default credentials that are hardcoded in the firmware and can be extracted by anyone who reverses the firmware to identify them. If the firmware version V2.420.AC00.16.R 9/9/2016 is dissected using binwalk tool, one obtains a user-x.squashfs.img.extracted archive which contains the filesystem set up on the device that many of the binaries in the /usr folder. The binary "sonia" is the one that has the vulnerable function that sets up the default credentials on the device. If one opens this binary in IDA-pro, one will notice that this follows a ARM little endian format. The function sub3DB2FC in IDA pro is identified to be setting up the values at address 0x003DB5A6. The sub5C057C then sets this value and adds it to the Configuration files in /mnt/mtd/Config/Account1 file.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2017-8226?
The severity of CVE-2017-8226 is critical with a CVSS score of 9.8.
Which Amcrest devices are affected by CVE-2017-8226?
Amcrest IPM-721S V2.420.AC00.16.R.20160909 devices are affected by CVE-2017-8226.
What is the vulnerability description of CVE-2017-8226?
CVE-2017-8226 is a vulnerability in Amcrest IPM-721S V2.420.AC00.16.R.20160909 devices that have default credentials hardcoded in the firmware, which can be extracted by reversing the firmware.
How can the default credentials be obtained in Amcrest IPM-721S V2.420.AC00.16.R.20160909 devices?
The default credentials in Amcrest IPM-721S V2.420.AC00.16.R.20160909 devices can be obtained by reversing the firmware using a tool like binwalk.
Are all versions of Amcrest IPM-721S affected by CVE-2017-8226?
No, only the devices running firmware version V2.420.AC00.16.R 9/9/2016 are affected by CVE-2017-8226.