PT-2019-8610 · Amcrest · Amcrest Ipm-721S

Mandar Satam · Published 2019-07-03 · Updated 2019-07-11 · CVE-2017-8228

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Amcrest IPM-721S version V2.420.AC00.16.R.20160909

Description The Amcrest IPM-721S device mishandles reboots within the past two hours, and Amcrest cloud services do not perform thorough verification when adding a new camera to a user's account. This allows an attacker who knows the serial number to add another user's camera to their cloud account and control it completely. The attack is possible if the camera is not part of an Amcrest cloud account or has been removed from the user's cloud account, and the user has rebooted the camera in the last two hours. A successful attack results in the attacker being able to view and listen to what the camera can see, change motion detection settings, and turn the camera off without the user's awareness.

Recommendations For Amcrest IPM-721S version V2.420.AC00.16.R.20160909, as a temporary workaround, consider restricting access to the camera's cloud account and avoiding reboots within a two-hour window to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Weakness Enumeration

CWE-264

Related Identifiers

CVE-2017-8228

Affected Products

Amcrest Ipm-721S

References · 6

• 🔥 https://github.com/ethanhunnt/IoT_vulnerabilities/blob/master/Amcrest_sec_issues.pdf · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2017-8228 · Security Note
• https://osv.dev/vulnerability/CVE-2017-8228 · Vendor Advisory
• https://seclists.org/bugtraq/2019/Jun/8 · Note
• http://packetstormsecurity.com/files/153224/Amcrest-IPM-721S-Credential-Disclosure-Privilege-Escalation.html · Note
• https://t.me/cibsecurity/5351 · Telegram Post