PT-2025-29277 · Shenzhen Liandian Communication Technology · Oem Ip Camera

Aoun Shah · Publicado 2025-07-11 · Atualizado 2025-09-28 · CVE-2025-7503

Positive Technologies (AI Summary)

CVSS v4.0

10

Crítica

Vetor base

AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:Red

Name of the Vulnerable Software and Affected Versions: Shenzhen Liandian Communication Technology LTD OEM IP Camera version AppFHE1 V1.0.6.0

Description: An OEM IP camera manufactured by Shenzhen Liandian Communication Technology LTD exposes a Telnet service (port 23) with undocumented, default credentials. The Telnet service is enabled by default and is not disclosed or configurable via the device’s web interface or user manual. An attacker with network access can authenticate using default credentials and gain root-level shell access to the device, allowing for remote code execution and privilege escalation.

Recommendations: For version AppFHE1 V1.0.6.0, as there is no official fix or firmware update available, consider disabling the Telnet service if possible.

Correção

LPE

RCE

Using Hardcoded Credentials

Enumeração de Fraquezas

CWE-798

Identificadores relacionados

CVE-2025-7503

Produtos afetados

Oem Ip Camera

Referências · 17

• https://github.com/AounShAh/Research-on-v380-cctv-ip-camera · Nota
• https://reddit.com/r/CVEWatch/comments/1m07b9n/top_10_trending_cves_15072025 · Publicação no Reddit
• https://twitter.com/PurpleOps_io/status/1945001019630305368 · Publicação no Twitter
• https://twitter.com/CyberHub_blog/status/1945177083749036525 · Publicação no Twitter
• https://twitter.com/the_yellow_fall/status/1944587499755708704 · Publicação no Twitter
• https://t.me/pentestingnews/64410 · Publicação no Telegram
• https://t.me/cvetracker/27597 · Publicação no Telegram
• https://twitter.com/fridaysecurity/status/1944588088484786635 · Publicação no Twitter
• https://reddit.com/r/CVEWatch/comments/1lzihof/top_10_trending_cves_14072025 · Publicação no Reddit
• https://twitter.com/CveFindCom/status/1943749564411834750 · Publicação no Twitter
• https://twitter.com/VulmonFeeds/status/1943832652420677774 · Publicação no Twitter
• https://twitter.com/freedomhack101/status/1946555291115692220 · Publicação no Twitter
• https://reddit.com/r/CVEWatch/comments/1m18qqc/top_10_trending_cves_16072025 · Publicação no Reddit
• https://twitter.com/CVEnew/status/1943750560005370117 · Publicação no Twitter
• https://nvd.nist.gov/vuln/detail/CVE-2025-7503 · Nota de Segurança