PT-2017-3359 · Acti · Acti Cameras

Mandar Jadhav · Published 2017-01-20 · Updated 2019-10-09 · CVE-2017-3184

Positive Technologies (AI Summary)

CVSS v3.1

10

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions ACTi cameras versions A1D-500-V6.11.31-AC

Description The issue is related to inadequate access control in the firmware of ACTi cameras, which can be exploited by a remote attacker. By directly accessing the "http://x.x.x.x/setup/setup maintain firmware-default.html" page, an attacker can perform a factory reset on the device. This can lead to a denial of service condition or allow the attacker to access the device using default credentials.

Recommendations For version A1D-500-V6.11.31-AC, consider restricting access to the factory reset page as a temporary workaround until a patch is available. Avoid using the default credentials in the affected API endpoint until the issue is resolved. As a mitigation measure, restrict access to the setup maintain firmware-default.html page to minimize the risk of exploitation.

Fix

Missing Authentication

Improper Access Control

Using Hardcoded Credentials

Weakness Enumeration

CWE-306

CWE-284

CWE-798

Related Identifiers

BDU:2018-00130

CVE-2017-3184

Affected Products

Acti Cameras

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2017-3184 · Security Note
• https://osv.dev/vulnerability/CVE-2017-3184 · Vendor Advisory
• https://bdu.fstec.ru/vul/2018-00130 · Security Note
• http://securityfocus.com/bid/96720/info · Note
• https://twitter.com/hack3rsca/status/839599437907386368 · Note
• https://twitter.com/Hfuhs/status/839252357221330944 · Note
• https://kb.cert.org/vuls/id/355151 · Note