PT-2016-1284 · Zhuhai Raysharp · Zhuhai Raysharp Firmware

Junia Valente · Published 2016-02-18 · Updated 2016-03-07 · CVE-2015-8286

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Zhuhai RaySharp firmware (affected versions not specified)

Description The issue concerns a hardcoded root password in the firmware, making it easier for remote attackers to gain access through a session on TCP port 23 or 9000. This could allow an attacker to obtain protected information.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Weakness Enumeration

CWE-254

Related Identifiers

BDU:2016-00581

CVE-2015-8286

Affected Products

Zhuhai Raysharp Firmware

References · 8

• 🔥 http://seclists.org/bugtraq/2015/Jun/117 · Exploit
• 🔥 http://console-cowboys.blogspot.com/2013/01/swann-song-dvr-insecurity.html · Exploit
• https://bdu.fstec.ru/vul/2016-00581 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2015-8286 · Security Note
• http://forbes.com/sites/andygreenberg/2013/01/28/more-than-a-dozen-brands-of-security-camera-systems-vulnerable-to-hacker-hijacking · Note
• http://kb.cert.org/vuls/id/899080 · Note
• https://community.rapid7.com/community/metasploit/blog/2013/01/23/ray-sharp-cctv-dvr-password-retrieval-remote-root · Note
• http://kb.cert.org/vuls/id/923388 · Note