Critical IoT Camera Flaw Allows for Device Hijacking

guest · Aug 27, 2021

Critical IoT Camera Flaw Allows for Device Hijacking
August 27, 2021
https://www.infosecurity-magazine.com/news/critical-iot-camera-flaw-allows/

Security researchers have discovered another critical bug in IoT security camera systems that could allow attackers to hijack devices.

Nozomi Networks found remote code execution vulnerability CVE-2021-32941 in the web service of the Annke N48PBB network video recorder (NVR) — used by consumers and businesses.
NVRs are an important part of any connected security camera system in that they’re designed to capture, store and manage incoming video feeds from IP cameras.
Click to expand...

If exploited, the vulnerability could cause a stack-based buffer overflow, allowing an unauthenticated, remote attacker to access sensitive information and execute code, according to an ICS advisory from the Cybersecurity and Infrastructure Security Agency (CISA).

The bug itself could be exploited directly by attackers to elevate privileges on the system and indirectly in drive-by-download attacks.

“It is sufficient for an administrator, operator, or user to browse a specifically crafted webpage, while simultaneously logged in to the web interface of the device, to potentially cause the execution of external malicious code on the device itself,” warned Nozomi.
Click to expand...

Nozomi Networks Labs: New Annke Vulnerability Shows Risks of IoT Security Camera Systems

Nozomi Networks Labs has discovered a critical Remote Code Execution (RCE) vulnerability (CVE-2021-32941) related to the web service of the Annke N48PBB network video recorder (NVR). This information is being shared as part of a coordinated disclosure with ICS-CERT, which published advisory ICSA-21-238-02, and with the vendor, Annke, which has released firmware that fixes the issue.
Click to expand...

Log in or Sign up

Critical IoT Camera Flaw Allows for Device Hijacking

guest Guest

Log in or Sign up

Critical IoT Camera Flaw Allows for Device Hijacking

guest Guest

Useful Searches