Chinese ip multiviewer ver 1.4.2.1 serial number#
Chinese ip multiviewer ver 1.4.2.1 update#
Chinese ip multiviewer ver 1.4.2.1 software#
Chinese ip multiviewer ver 1.4.2.1 code#

The HTTP interface is provided by a custom http server. Issuer=/C=US/O=Apple Inc./OU=Apple Worldwide Developer Relations/CN=Apple Worldwide Developer Relations Certification Authorityĭetails - CVE-2017-8225 - Pre-Auth Info Leak (credentials) within the custom http server Subject=/UID=/CN=Apple Production IOS Push Services: /OU=SQ6NNPBE2K/C=US

telnet 192.168.1.107Ĭonnection backdoor account exists in the camera: root:$1$ybdHbPDn$ii9aEIFNiolBbM9QxW9mr0:0:0::/root:/bin/shĭetails - CVE-2017-8222 - RSA key and certificatesįriendlyName: Apple Production IOS Push Services: The complete list of 1250 affected camera models has been removed.ĭetails - CVE-2017-8224 - Backdoor accountīy default, telnetd is running on the camera.

Chinese ip multiviewer ver 1.4.2.1 update#

Thus, these cameras are likely affected by a pre-auth RCE as root: Update (Mar 16, 2017): Following the strong requests from a specific vendor, It can be used to execute the RCE as root. My tests have shown that the InfoLeak affecting the custom http server running on the camera affects at least 1250+ camera models. The vulnerabilities in the Cloud management affect a lot of P2P or 'Cloud' cameras. CVE-2017-8223 - Misc - Streaming without authentication.CVE-2017-8225 - Pre-Auth Info Leak (credentials) within the custom http server.CVE-2017-8222 - RSA key and certificates.Which allow to execute root commands against 1250+ camera models with a pre-auth vulnerability.

Chinese ip multiviewer ver 1.4.2.1 code#

Specific development around GoAhead is responsible for the cause of vulnerabilities.īecause of code reusing, the vulnerabilities are present in a huge list of cameras (especially the InfoLeak and the RCE), GoAhead stated that GoAhead itself is not affected by the vulnerabilities but the OEM vendor who did the custom and The OEM vendors used a custom version of GoAhead and added vulnerable code inside.

Interface is different for each vendor but shares the same vulnerabilities. So, cameras are sold under different names, brands and functions. Wireless IP Camera (P2) WIFICAM is one of the branded cameras.

Chinese ip multiviewer ver 1.4.2.1 software#

The buyer companies resell them with custom software development and specific branding. It seems that a generic camera is being sold by a Chinese company in bulk (OEM) and This camera is very similar to a lot of other Chinese cameras. The Wireless IP Camera (P2) WIFICAM is a camera overall badly designed with a lot of vulnerabilities. The Wireless IP Camera (P2P) WIFICAM is a Chinese web camera which allows to stream remotely. Then, the attacker can automaticaly bruteforce the credentials of cameras.

Chinese ip multiviewer ver 1.4.2.1 serial number#

The 'Cloud' protocol establishes clear-text UDP tunnels (in order to bypass NAT and firewalls) between an attacker and cameras by using only the serial number of the targeted camera.

Note: All specifications are subject to change without prior notice.TL DR: by analysing the security of a camera, I found a pre-auth RCE as root against 1250 camera models. Note: The Playback Mode is not available when you access the recordings saved on the NAS System.Īrabic / Bulgarian / Czech / Danish / Dutch / English / Finnish / French / German / Greek / Hebrew / Hungarian / Indonesian / Italian /Japanese / Lithuanian / Norwegian / Persian / Polish / Portuguese / Romanian / Russian / Serbian / Simplified Chinese / Slovakian / Slovenian / Spanish / Swedish / Thai / Traditional Chinese / Turkish Note: NAS setup is supported by GV-IP Camera (firmware V3.0 or later), GV-Target Camera (firmware V1.02 or later), GV-EFD2101/EFD3101/EVD2100/EVD3100 (firmware V1.00 or later)įisheye dewarping, wide angle lens dewarping, defog, PIP, PAP, Stabilizer NAS setup, IP address configuration, time synchronization with GV-Edge Recording Manager (for GV-IP Devices)

Fisheye dewarping, PIP, PAP, wide angle lens dewarping, fisheye object tracking, zoom, snapshotĮnable/disable monitoring of a single host or all hosts (for GV-IP Devices)