PT-2019-8612 · Amcrest · Amcrest Ipm-721S

Published 2019-07-03 · Updated 2019-07-11 · CVE-2017-8230

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Amcrest IPM-721S version V2.420.AC00.16.R.20160909

Description A security issue was identified in Amcrest IPM-721S devices, where a low-privileged user belonging to the "user" group can add a new administrative user to the web administrative interface using HTTP APIs, allowing them to perform actions as an administrative user. The binary "sonia" contains vulnerable functions that perform various actions described in HTTP APIs. The function at address 0x00429084 processes the HTTP API request for the "addUser" action, and the function sub 41F38C at address 0x0041F588 parses the call received from the browser and passes it to the "addUser" function without any authorization check.

Recommendations For Amcrest IPM-721S version V2.420.AC00.16.R.20160909, consider disabling the "addUser" function in the "sonia" binary until a patch is available to prevent low-privileged users from adding new administrative users. Restrict access to the HTTP API endpoints that allow user addition to minimize the risk of exploitation. Avoid using the "addUser" action in the HTTP API until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Weakness Enumeration

CWE-264

Related Identifiers

CVE-2017-8230

Affected Products

Amcrest Ipm-721S

References · 5

• 🔥 https://github.com/ethanhunnt/IoT_vulnerabilities/blob/master/Amcrest_sec_issues.pdf · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2017-8230 · Security Note
• https://osv.dev/vulnerability/CVE-2017-8230 · Vendor Advisory
• http://packetstormsecurity.com/files/153224/Amcrest-IPM-721S-Credential-Disclosure-Privilege-Escalation.html · Note
• https://t.me/cibsecurity/5349 · Telegram Post