Denver IP Camera SHO-110 - Unauthenticated Snapshot

vendor:

Denver SHO-110

by:

Ivan Nikolsky (enty8080)

7,5

CVSS

HIGH

Backdoor

287

CWE

Product Name: Denver SHO-110

Affected Version From: All firmware versions

Affected Version To: All firmware versions

Patch Exists: NO

Related CWE: N/A

CPE: h:denver:sho-110

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: Denver SHO-110

2021

Denver IP Camera SHO-110 – Unauthenticated Snapshot

A backdoor was found in a Denver SHO-110 IP Camera. The backdoor located in the camera's second http service, allows the attacker to get a snapshot through `/snapshot` endpoint without authentication.

Mitigation:

Ensure that all services are properly secured and authenticated.

Source

Exploit-DB raw data:

# Exploit Title: Denver IP Camera SHO-110 - Unauthenticated Snapshot
# Date: 28 July 2021
# Exploit Author: Ivan Nikolsky (enty8080)
# Vendor Homepage: https://denver.eu/products/smart-home-security/denver-sho-110/c-1024/c-1243/p-3826
# Version: Denver SHO-110 (all firmware versions)
# Tested on: Denver SHO-110

Backdoor was found in a Denver SHO-110 IP Camera. Maybe other models also have this backdoor too.

So, the backdoor located in the camera's second http service, allows the attacker to get a snapshot through `/snapshot` endpoint. There are two http services in camera: first - served on port 80, and it requires authentication, and the second - served on port 8001, and it does not require authentication.

It's possible to write a script that will collect snapshots and add them to each other, so the attacker will be able to disclosure the camera stream.

PoC:

http://<host>:8001/snapshot