PT-2019-13022 · Shenzhen Cylan · Clever Dog Smart Camera

Publicado 2019-06-20 · Atualizado 2019-06-27 · CVE-2019-12920

Positive Technologies (AI Summary)

CVSS v2.0

10

Alta

Vetor base

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Shenzhen Cylan Clever Dog Smart Camera versions DOG-2W and DOG-2W-V4

Description The issue allows an attacker on the network to login remotely to the camera and gain root access. This is possible because the device ships with a hardcoded password 12345678 for the root account, which is accessible from a TELNET login prompt.

Recommendations For versions DOG-2W and DOG-2W-V4, change the hardcoded root password 12345678 to a unique and strong password to prevent unauthorized access. As a temporary workaround, consider disabling the TELNET login prompt until a patch is available. Restrict access to the root account to minimize the risk of exploitation.

Correção

Using Hardcoded Credentials

Enumeração de Fraquezas

CWE-798

Identificadores relacionados

CVE-2019-12920

Produtos afetados

Clever Dog Smart Camera

Referências · 2

• https://nvd.nist.gov/vuln/detail/CVE-2019-12920 · Nota de Segurança
• https://exploit-db.com/exploits/46993 · Nota