Details of VAR-201612-0635

ID

VAR-201612-0635

TITLE

Many Sony IPELA ENGINE IP Cameras have backdoor vulnerabilities

Trust: 0.6

sources: CNVD: CNVD-2016-11973

DESCRIPTION

SNC-CH115, SNC-CH120, SNC-CH160, etc. are Sony’s IP camera products. Many Sony IPELA ENGINE IP Cameras have backdoor vulnerabilities. Remote attackers can use the vulnerabilities to use Telnet/SSH services for remote management, thereby gaining root privileges of the Linux shell, affecting camera image quality and other functions.

Trust: 0.6

sources: CNVD: CNVD-2016-11973

IOT TAXONOMY

category:

['Network device']

sub_category:

Trust: 0.6

sources: CNVD: CNVD-2016-11973

AFFECTED PRODUCTS

vendor:	sony	model:	ipela engine ip cameras snc-vb600	scope:	lt	version:	2.7.2	Trust: 0.6
vendor:	sony	model:	ipela engine ip cameras snc-ch115	scope:	lt	version:	1.86.00	Trust: 0.6
vendor:	sony	model:	ipela engine ip cameras snc-ch120	scope:	lt	version:	1.86.00	Trust: 0.6
vendor:	sony	model:	ipela engine ip cameras snc-ch160	scope:	lt	version:	1.86.00	Trust: 0.6
vendor:	sony	model:	ipela engine ip cameras snc-ch220	scope:	lt	version:	1.86.00	Trust: 0.6
vendor:	sony	model:	ipela engine ip cameras snc-ch260	scope:	lt	version:	1.86.00	Trust: 0.6
vendor:	sony	model:	ipela engine ip cameras snc-cx600	scope:	lt	version:	2.7.2	Trust: 0.6
vendor:	sony	model:	ipela engine ip cameras snc-cx600w	scope:	lt	version:	2.7.2	Trust: 0.6
vendor:	sony	model:	ipela engine ip cameras snc-dh120	scope:	lt	version:	1.86.00	Trust: 0.6
vendor:	sony	model:	ipela engine ip cameras snc-dh120t	scope:	lt	version:	1.86.00	Trust: 0.6
vendor:	sony	model:	ipela engine ip cameras snc-dh160	scope:	lt	version:	1.86.00	Trust: 0.6
vendor:	sony	model:	ipela engine ip cameras snc-dh220	scope:	lt	version:	1.86.00	Trust: 0.6
vendor:	sony	model:	ipela engine ip cameras snc-dh220t	scope:	lt	version:	1.86.00	Trust: 0.6
vendor:	sony	model:	ipela engine ip cameras snc-dh260	scope:	lt	version:	1.86.00	Trust: 0.6
vendor:	sony	model:	ipela engine ip cameras snc-eb520	scope:	lt	version:	1.86.00	Trust: 0.6
vendor:	sony	model:	ipela engine ip cameras snc-eb600	scope:	lt	version:	2.7.2	Trust: 0.6
vendor:	sony	model:	ipela engine ip cameras snc-eb600b	scope:	lt	version:	2.7.2	Trust: 0.6
vendor:	sony	model:	ipela engine ip cameras snc-eb602r	scope:	lt	version:	2.7.2	Trust: 0.6
vendor:	sony	model:	ipela engine ip cameras snc-eb630	scope:	lt	version:	2.7.2	Trust: 0.6
vendor:	sony	model:	ipela engine ip cameras snc-eb630b	scope:	lt	version:	2.7.2	Trust: 0.6
vendor:	sony	model:	ipela engine ip cameras snc-eb632r	scope:	lt	version:	2.7.2	Trust: 0.6
vendor:	sony	model:	ipela engine ip cameras snc-em520	scope:	lt	version:	1.86.00	Trust: 0.6
vendor:	sony	model:	ipela engine ip cameras snc-em521	scope:	lt	version:	1.86.00	Trust: 0.6
vendor:	sony	model:	ipela engine ip cameras snc-em600	scope:	lt	version:	2.7.2	Trust: 0.6
vendor:	sony	model:	ipela engine ip cameras snc-em601	scope:	lt	version:	2.7.2	Trust: 0.6
vendor:	sony	model:	ipela engine ip cameras snc-em602r	scope:	lt	version:	2.7.2	Trust: 0.6
vendor:	sony	model:	ipela engine ip cameras snc-em602rc	scope:	lt	version:	2.7.2	Trust: 0.6
vendor:	sony	model:	ipela engine ip cameras snc-em630	scope:	lt	version:	2.7.2	Trust: 0.6
vendor:	sony	model:	ipela engine ip cameras snc-em631	scope:	lt	version:	2.7.2	Trust: 0.6
vendor:	sony	model:	ipela engine ip cameras snc-em632r	scope:	lt	version:	2.7.2	Trust: 0.6
vendor:	sony	model:	ipela engine ip cameras snc-em632rc	scope:	lt	version:	2.7.2	Trust: 0.6
vendor:	sony	model:	ipela engine ip cameras snc-ep520	scope:	lt	version:	1.86.00	Trust: 0.6
vendor:	sony	model:	ipela engine ip cameras snc-ep521	scope:	lt	version:	1.86.00	Trust: 0.6
vendor:	sony	model:	ipela engine ip cameras snc-ep550	scope:	lt	version:	1.86.00	Trust: 0.6
vendor:	sony	model:	ipela engine ip cameras snc-ep580	scope:	lt	version:	1.86.00	Trust: 0.6
vendor:	sony	model:	ipela engine ip cameras snc-er520	scope:	lt	version:	1.86.00	Trust: 0.6
vendor:	sony	model:	ipela engine ip cameras snc-er521	scope:	lt	version:	1.86.00	Trust: 0.6
vendor:	sony	model:	ipela engine ip cameras snc-er521c	scope:	lt	version:	1.86.00	Trust: 0.6
vendor:	sony	model:	ipela engine ip cameras snc-er550	scope:	lt	version:	1.86.00	Trust: 0.6
vendor:	sony	model:	ipela engine ip cameras snc-er550c	scope:	lt	version:	1.86.00	Trust: 0.6
vendor:	sony	model:	ipela engine ip cameras snc-er580	scope:	lt	version:	1.86.00	Trust: 0.6
vendor:	sony	model:	ipela engine ip cameras snc-er585	scope:	lt	version:	1.86.00	Trust: 0.6
vendor:	sony	model:	ipela engine ip cameras snc-er585h	scope:	lt	version:	1.86.00	Trust: 0.6
vendor:	sony	model:	ipela engine ip cameras snc-vb600b	scope:	lt	version:	2.7.2	Trust: 0.6
vendor:	sony	model:	ipela engine ip cameras snc-vb600b5	scope:	lt	version:	2.7.2	Trust: 0.6
vendor:	sony	model:	ipela engine ip cameras snc-vb600l	scope:	lt	version:	2.7.2	Trust: 0.6
vendor:	sony	model:	ipela engine ip cameras snc-vb630	scope:	lt	version:	2.7.2	Trust: 0.6
vendor:	sony	model:	ipela engine ip cameras snc-vb6305	scope:	lt	version:	2.7.2	Trust: 0.6
vendor:	sony	model:	ipela engine ip cameras snc-vb6307	scope:	lt	version:	2.7.2	Trust: 0.6
vendor:	sony	model:	ipela engine ip cameras snc-vb632d	scope:	lt	version:	2.7.2	Trust: 0.6
vendor:	sony	model:	ipela engine ip cameras snc-vb635	scope:	lt	version:	2.7.2	Trust: 0.6
vendor:	sony	model:	ipela engine ip cameras snc-vm600	scope:	lt	version:	2.7.2	Trust: 0.6
vendor:	sony	model:	ipela engine ip cameras snc-vm600b	scope:	lt	version:	2.7.2	Trust: 0.6
vendor:	sony	model:	ipela engine ip cameras snc-vm600b5	scope:	lt	version:	2.7.2	Trust: 0.6
vendor:	sony	model:	ipela engine ip cameras snc-vm600l	scope:	lt	version:	2.7.2	Trust: 0.6
vendor:	sony	model:	ipela engine ip cameras snc-vm601	scope:	lt	version:	2.7.2	Trust: 0.6
vendor:	sony	model:	ipela engine ip cameras snc-vm601b	scope:	lt	version:	2.7.2	Trust: 0.6
vendor:	sony	model:	ipela engine ip cameras snc-vm602r	scope:	lt	version:	2.7.2	Trust: 0.6
vendor:	sony	model:	ipela engine ip cameras snc-vm630	scope:	lt	version:	2.7.2	Trust: 0.6
vendor:	sony	model:	ipela engine ip cameras snc-vm6305	scope:	lt	version:	2.7.2	Trust: 0.6
vendor:	sony	model:	ipela engine ip cameras snc-vm6307	scope:	lt	version:	2.7.2	Trust: 0.6
vendor:	sony	model:	ipela engine ip cameras snc-vm631	scope:	lt	version:	2.7.2	Trust: 0.6
vendor:	sony	model:	ipela engine ip cameras snc-vm632r	scope:	lt	version:	2.7.2	Trust: 0.6
vendor:	sony	model:	ipela engine ip cameras snc-wr600	scope:	lt	version:	2.7.2	Trust: 0.6
vendor:	sony	model:	ipela engine ip cameras snc-wr602	scope:	lt	version:	2.7.2	Trust: 0.6
vendor:	sony	model:	ipela engine ip cameras snc-wr602c	scope:	lt	version:	2.7.2	Trust: 0.6
vendor:	sony	model:	ipela engine ip cameras snc-wr602cl	scope:	lt	version:	2.7.2	Trust: 0.6
vendor:	sony	model:	ipela engine ip cameras snc-wr630	scope:	lt	version:	2.7.2	Trust: 0.6
vendor:	sony	model:	ipela engine ip cameras snc-wr632	scope:	lt	version:	2.7.2	Trust: 0.6
vendor:	sony	model:	ipela engine ip cameras snc-wr632c	scope:	lt	version:	2.7.2	Trust: 0.6
vendor:	sony	model:	ipela engine ip cameras snc-xm631	scope:	lt	version:	2.7.2	Trust: 0.6
vendor:	sony	model:	ipela engine ip cameras snc-xm631l	scope:	lt	version:	2.7.2	Trust: 0.6
vendor:	sony	model:	ipela engine ip cameras snc-xm632	scope:	lt	version:	2.7.2	Trust: 0.6
vendor:	sony	model:	ipela engine ip cameras snc-xm636	scope:	lt	version:	2.7.2	Trust: 0.6
vendor:	sony	model:	ipela engine ip cameras snc-xm637	scope:	lt	version:	2.7.2	Trust: 0.6
vendor:	sony	model:	ipela engine ip cameras snc-zb550	scope:	lt	version:	1.86.00	Trust: 0.6
vendor:	sony	model:	ipela engine ip cameras snc-zm550	scope:	lt	version:	1.86.00	Trust: 0.6
vendor:	sony	model:	ipela engine ip cameras snc-zm551	scope:	lt	version:	1.86.00	Trust: 0.6
vendor:	sony	model:	ipela engine ip cameras snc-zp550	scope:	lt	version:	1.86.00	Trust: 0.6
vendor:	sony	model:	ipela engine ip cameras snc-zr550	scope:	lt	version:	1.86.00	Trust: 0.6

sources: CNVD: CNVD-2016-11973

CVSS

SEVERITY

CVSSV2

CVSSV3

CNVD:	CNVD-2016-11973
value:	HIGH
Trust: 0.6

CNVD:	CNVD-2016-11973
severity:	HIGH
baseScore:	10.0
vectorString:	AV:N/AC:L/AU:N/C:C/I:C/A:C
accessVector:	NETWORK
accessComplexity:	LOW
authentication:	NONE
confidentialityImpact:	COMPLETE
integrityImpact:	COMPLETE
availabilityImpact:	COMPLETE
exploitabilityScore:	10.0
impactScore:	10.0
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 0.6

sources: CNVD: CNVD-2016-11973

PATCH

title:

Patch for Many Sony IPELA ENGINE IP Cameras have backdoor vulnerabilities

url:

https://www.cnvd.org.cn/patchinfo/show/85262

Trust: 0.6

sources: CNVD: CNVD-2016-11973

EXTERNAL IDS

db:

CNVD

id:

CNVD-2016-11973

Trust: 0.6

sources: CNVD: CNVD-2016-11973

REFERENCES

url:

https://www.sec-consult.com/fxdata/seccons/prod/temedia/advisories_txt/20161206-0_sony_ipela_engine_ip_cameras_backdoors_v10.txt

Trust: 0.6

sources: CNVD: CNVD-2016-11973

SOURCES

db:

CNVD

id:

CNVD-2016-11973

LAST UPDATE DATE

2022-05-04T10:04:51.947000+00:00

SOURCES UPDATE DATE

db:

CNVD

id:

CNVD-2016-11973

date:

2020-03-10T00:00:00

SOURCES RELEASE DATE

db:

CNVD

id:

CNVD-2016-11973

date:

2016-12-07T00:00:00