Sign-up

ID

VAR-201808-0161


CVE

CVE-2017-11563


TITLE

D-Link EyeOn Baby Monitor Buffer error vulnerability

Trust: 0.8

sources: JVNDB: JVNDB-2017-014242

DESCRIPTION

D-Link EyeOn Baby Monitor (DCS-825L) 1.08.1 has a remote code execution vulnerability. A UDP "Discover" service, which provides multiple functions such as changing the passwords and getting basic information, was installed on the device. A remote attacker can send a crafted UDP request to finderd to perform stack overflow and execute arbitrary code with root privilege on the device. D-Link EyeOn Baby Monitor (DCS-825L) Contains a buffer error vulnerability.Information is obtained, information is altered, and service operation is disrupted (DoS) There is a possibility of being put into a state. The EyeOnBabyMonitorDCS-825L is a baby monitor from D-Link. # Vulnerability Type Buffer Overflow # Affected Product Code Base DCS-825L EyeOn Baby Monitor - 1.08.1 # Affected Component finderd daemon (Device Discovery) # Attack Type Remote # Attack Vectors Send crafted UDP packets to overflow buffer and lead to remote code execution # Discoverer Dove Chiu (Trend Micro) and Kenney Lu (Trend Micro) # Vulnerability Details A UDP aDiscovera service, which provides multiple functions such as changing the passwords and getting basic information, was installed on the device. Reference: https://documents.trendmicro.com/assets/tech_brief_Device_Vulnerabilities_in_the_Connected_Home2.pdf # Status Fixed in the latest beta firmware <table class="TM_EMAIL_NOTICE"><tr><td><pre> TREND MICRO EMAIL NOTICE The information contained in this email and any attachments is confidential and may be subject to copyright or other intellectual property protection. If you are not the intended recipient, you are not authorized to use or disclose this information, and we request that you notify us by reply mail or telephone and delete the original message from your mail system. </pre></td></tr></table>

Trust: 2.43

sources: NVD: CVE-2017-11563 // JVNDB: JVNDB-2017-014242 // CNVD: CNVD-2018-15838 // VULHUB: VHN-101998 // VULMON: CVE-2017-11563 // PACKETSTORM: 149053

IOT TAXONOMY

category:['ICS', 'Network device']sub_category: -

Trust: 0.6

sources: CNVD: CNVD-2018-15838

AFFECTED PRODUCTS

vendor:dlinkmodel:eyeon baby monitorscope:eqversion:1.08.1

Trust: 1.6

vendor:d linkmodel:eyeon baby monitorscope:eqversion:1.08.1

Trust: 0.8

vendor:d linkmodel:dcs-825l eyeon baby monitorscope:eqversion:1.08.1

Trust: 0.6

sources: CNVD: CNVD-2018-15838 // JVNDB: JVNDB-2017-014242 // CNNVD: CNNVD-201707-1032 // NVD: CVE-2017-11563

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2017-11563
value: CRITICAL

Trust: 1.0

NVD: CVE-2017-11563
value: CRITICAL

Trust: 0.8

CNVD: CNVD-2018-15838
value: HIGH

Trust: 0.6

CNNVD: CNNVD-201707-1032
value: CRITICAL

Trust: 0.6

VULHUB: VHN-101998
value: HIGH

Trust: 0.1

VULMON: CVE-2017-11563
value: HIGH

Trust: 0.1

nvd@nist.gov: CVE-2017-11563
severity: HIGH
baseScore: 10.0
vectorString: AV:N/AC:L/AU:N/C:C/I:C/A:C
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: COMPLETE
integrityImpact: COMPLETE
availabilityImpact: COMPLETE
exploitabilityScore: 10.0
impactScore: 10.0
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.9

CNVD: CNVD-2018-15838
severity: HIGH
baseScore: 10.0
vectorString: AV:N/AC:L/AU:N/C:C/I:C/A:C
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: COMPLETE
integrityImpact: COMPLETE
availabilityImpact: COMPLETE
exploitabilityScore: 10.0
impactScore: 10.0
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.6

VULHUB: VHN-101998
severity: HIGH
baseScore: 10.0
vectorString: AV:N/AC:L/AU:N/C:C/I:C/A:C
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: COMPLETE
integrityImpact: COMPLETE
availabilityImpact: COMPLETE
exploitabilityScore: 10.0
impactScore: 10.0
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.1

nvd@nist.gov: CVE-2017-11563
baseSeverity: CRITICAL
baseScore: 9.8
vectorString: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: 3.9
impactScore: 5.9
version: 3.0

Trust: 1.8

sources: CNVD: CNVD-2018-15838 // VULHUB: VHN-101998 // VULMON: CVE-2017-11563 // JVNDB: JVNDB-2017-014242 // CNNVD: CNNVD-201707-1032 // NVD: CVE-2017-11563

PROBLEMTYPE DATA

problemtype:CWE-119

Trust: 1.9

sources: VULHUB: VHN-101998 // JVNDB: JVNDB-2017-014242 // NVD: CVE-2017-11563

THREAT TYPE

remote

Trust: 0.7

sources: PACKETSTORM: 149053 // CNNVD: CNNVD-201707-1032

TYPE

buffer overflow

Trust: 0.6

sources: CNNVD: CNNVD-201707-1032

CONFIGURATIONS

sources:
            
            
            JVNDB: JVNDB-2017-014242

PATCH
title:EyeOn Baby Monitor DCS-825Lurl:https://eu.dlink.com/uk/en/products/dcs-825l-wifi-baby-camera
Trust: 0.8
title:D-LinkEyeOnBabyMonitorDCS-825L Patch Overflow Remote Code Execution Vulnerability Patchurl:https://www.cnvd.org.cn/patchInfo/show/138177
Trust: 0.6
sources:
            
            
            CNVD: CNVD-2018-15838 // 
            
            
            
            JVNDB: JVNDB-2017-014242

EXTERNAL IDS
db:NVDid:CVE-2017-11563
Trust: 3.3
db:JVNDBid:JVNDB-2017-014242
Trust: 0.8
db:CNNVDid:CNNVD-201707-1032
Trust: 0.7
db:CNVDid:CNVD-2018-15838
Trust: 0.6
db:PACKETSTORMid:149053
Trust: 0.2
db:VULHUBid:VHN-101998
Trust: 0.1
db:VULMONid:CVE-2017-11563
Trust: 0.1
sources:
            
            
            CNVD: CNVD-2018-15838 // 
            
            
            
            VULHUB: VHN-101998 // 
            
            
            
            VULMON: CVE-2017-11563 // 
            
            
            
            JVNDB: JVNDB-2017-014242 // 
            
            
            
            PACKETSTORM: 149053 // 
            
            
            
            CNNVD: CNNVD-201707-1032 // 
            
            
            
            NVD: CVE-2017-11563

REFERENCES
url:https://documents.trendmicro.com/assets/tech_brief_device_vulnerabilities_in_the_connected_home2.pdf
Trust: 2.7
url:http://seclists.org/fulldisclosure/2018/aug/18
Trust: 2.5
url:https://nvd.nist.gov/vuln/detail/cve-2017-11563
Trust: 0.9
url:https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2017-11563
Trust: 0.8
url:https://cwe.mitre.org/data/definitions/119.html
Trust: 0.1
url:https://nvd.nist.gov
Trust: 0.1
sources:
            
            
            CNVD: CNVD-2018-15838 // 
            
            
            
            VULHUB: VHN-101998 // 
            
            
            
            VULMON: CVE-2017-11563 // 
            
            
            
            JVNDB: JVNDB-2017-014242 // 
            
            
            
            PACKETSTORM: 149053 // 
            
            
            
            CNNVD: CNNVD-201707-1032 // 
            
            
            
            NVD: CVE-2017-11563

CREDITS
Kenney Lu, Dove Chiu
Trust: 0.1
sources:
            
            
            PACKETSTORM: 149053

SOURCES
db:CNVDid:CNVD-2018-15838
db:VULHUBid:VHN-101998
db:VULMONid:CVE-2017-11563
db:JVNDBid:JVNDB-2017-014242
db:PACKETSTORMid:149053
db:CNNVDid:CNNVD-201707-1032
db:NVDid:CVE-2017-11563

LAST UPDATE DATE
2024-11-23T22:06:39.428000+00:00

SOURCES UPDATE DATE
db:CNVDid:CNVD-2018-15838date:2018-08-22T00:00:00
db:VULHUBid:VHN-101998date:2018-11-02T00:00:00
db:VULMONid:CVE-2017-11563date:2018-11-02T00:00:00
db:JVNDBid:JVNDB-2017-014242date:2018-11-28T00:00:00
db:CNNVDid:CNNVD-201707-1032date:2018-08-27T00:00:00
db:NVDid:CVE-2017-11563date:2024-11-21T03:08:01.733

SOURCES RELEASE DATE
db:CNVDid:CNVD-2018-15838date:2018-08-22T00:00:00
db:VULHUBid:VHN-101998date:2018-08-24T00:00:00
db:VULMONid:CVE-2017-11563date:2018-08-24T00:00:00
db:JVNDBid:JVNDB-2017-014242date:2018-11-28T00:00:00
db:PACKETSTORMid:149053date:2018-08-23T17:28:01
db:CNNVDid:CNNVD-201707-1032date:2017-07-24T00:00:00
db:NVDid:CVE-2017-11563date:2018-08-24T19:29:00.267