PT-2019-7818 · Milesight · Milesight Ip Security Cameras

Published 2019-10-25 · Updated 2019-10-29 · CVE-2016-2358

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Milesight IP security cameras versions prior to 2016-11-14

Description The issue concerns Milesight IP security cameras that have a default set of 10 privileged accounts with hardcoded credentials. These accounts are accessible if the customer has not configured 10 actual user accounts.

Recommendations For Milesight IP security cameras versions prior to 2016-11-14, configure 10 actual user accounts to override the default privileged accounts with hardcoded credentials.

Exploit

Fix

Using Hardcoded Credentials

Weakness Enumeration

CWE-798

Related Identifiers

CVE-2016-2358

Affected Products

Milesight Ip Security Cameras

References · 5

• 🔥 http://kirils.org/slides/2016-10-06_Milesight_initial.pdf · Exploit
• 🔥 https://youtube.com/watch?v=scckkI7CAW0 · Exploit
• https://osv.dev/vulnerability/CVE-2016-2358 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2016-2358 · Security Note
• https://possiblesecurity.com/news/vulnerabilities-of-milesight-ip-security-cameras · Note