CERT/CC Vulnerability Note VU#899080

Overview

Digital Video Recorders (DVRs), security cameras, and possibly other devices from multiple vendors use a firmware derived from Zhuhai RaySharp that contains a hard-coded root password.

Description

CWE-259: Use of Hard-coded Password - CVE-2015-8286

According to the reporter, DVR devices based on the Zhuhai RaySharp firmware contain a hard-coded root password. Remote attackers with knowledge of the password may gain root access to the device.

Furthermore, it was previously reported publicly that many of these devices enable remote access via telnet or port 9000 by default.

The CERT/CC has not been able to confirm this information directly with Zhuhai RaySharp. The Vendor List below provides more information on each manufacturer that was reported to be vulnerable.

The reporter, Risk Based Security, has provided security advisory RBS-2016-001 with more information.

Impact

An unauthenticated remote attacker may gain root access to the device.

Solution

Apply an update if possible

Some vendors have released updated firmware to address this issue. Please contact your device manufacturer for more information. The Vendor List below provides more information on each manufacturer that was reported to be vulnerable.

If your vendor does not have an updated firmware available at this time, you may consider the following mitigations:

Restrict network access

Use a firewall or similar technology to restrict access to trusted hosts, networks, and services.

Vendor Information

899080

Filter by status:

Filter by content: Additional information available

Sort by:

Expand all

Swann Affected

Zhuhai RaySharp Affected

Axis Communications Not Affected

Hanwha Not Affected

COP USA Unknown

CWD Unknown

KGuard Security Unknown

Konig Electronics Unknown

Lorex Corporation Unknown

CVSS Metrics

Group	Score	Vector
Base	10	AV:N/AC:L/Au:N/C:C/I:C/A:C
Temporal	8.5	E:POC/RL:U/RC:UR
Environmental	6.4	CDP:ND/TD:M/CR:ND/IR:ND/AR:ND

References

Acknowledgements

Thanks to Carsten Eiram of Risk Based Security for reporting these vulnerabilities.

This document was written by Garret Wassermann.

Other Information

CVE IDs:	CVE-2015-8286
Date Public:	2016-02-17
Date First Published:	2016-02-17
Date Last Updated:	2016-02-19 19:49 UTC
Document Revision:	71

Software Engineering Institute

CERT Coordination Center

Zhuhai Raysharp firmware for DVRs from multiple vendors contains hard-coded credentials

Vulnerability Note VU#899080