PT-2013-3848 · Tp Link · Tp-Link Ip Cameras

Published 2013-10-11 · Updated 2013-10-15 · CVE-2013-2579

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions TP-Link IP Cameras versions prior to beta firmware LM.1.6.18P12 sign6

Description The issue concerns an empty password for a hardcoded account, allowing remote attackers to gain administrative access. This is achieved through a TELNET session, exploiting the qmik account that has an empty password.

Recommendations For versions prior to beta firmware LM.1.6.18P12 sign6, update to beta firmware LM.1.6.18P12 sign6 or later to resolve the issue. As a temporary workaround, consider disabling TELNET access until a patch is available. Restrict access to the administrative interface to minimize the risk of exploitation.

Exploit

Fix

Weakness Enumeration

CWE-255

Related Identifiers

CVE-2013-2579

Affected Products

Tp-Link Ip Cameras

References · 3

• 🔥 https://exploit-db.com/exploits/27289 · Exploit
• 🔥 http://coresecurity.com/advisories/multiple-vulnerabilities-tp-link-tl-sc3171-ip-cameras · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2013-2579 · Security Note