Research exposes vulnerabilities in IP camera firmware used by multiple vendors

guest · Jul 13, 2021

Research exposes vulnerabilities in IP camera firmware used by multiple vendors
Flawed UDP code bundled in CCTV devices from Geutebrück, VCA, and Sprinx Technologies
July 12, 2021
https://portswigger.net/daily-swig/...n-ip-camera-firmware-used-by-multiple-vendors

Security researchers at Randorisec have uncovered numerous severe vulnerabilities in IP camera firmware from UDP Technology.

French security consultancy Randorisec said it had previously discovered several critical vulnerabilities in the firmware, ranging from authentication bypass to remote code execution (RCE).
Based on these earlier shortcomings, Randorisec took another pass at UDP technology, discovering a further 11 authenticated RCE and a complete authentication bypass vulnerabilities in the process.
Click to expand...

Randorisec disclosed the vulnerabilities in February and, following an extended disclosure engagement with Geutebrück, they were resolved with the release of a firmware update earlier this month.

This cleared the way for Randorisec to publish its blog post documenting the vulnerabilities.
These various flaws are tracked as CVE-2021-33543 through to CVE-2021-33554.

“Combining this authentication bypass [with] any of the RCE [vulnerabilities] gave us a root shell,” Douhine explained.
Click to expand...

Randorisec: UDP Technology IP Camera vulnerabilities

UDP Technology is providing a firmware for many IP Camera vendors such as:
Click to expand...

Geutebruck

Ganz

Visualint

Cap

THRIVE Intelligence

Sophus

VCA

TripCorps

Sprinx Technologies

Smartec

Riva

They’re also selling their own cameras under their brand in Asia.

We’ve already reported several critical vulnerabilities (from RCE to Authentication Bypass) discovered on Geutebruck products. Geutebruck has always been our main contact to reach UDP Technology. In fact, UDP Technology never deigned to acknowledge our reports despite numerous mails and LinkedIn messages. Because new firmwares were released, sometimes failing to patch correctly reported vulnerabilities, we decided to follow the release of newer firmware, looking for more vulnerabilities.

This time we found 11 authenticated RCE and a complete authentication bypass.
Click to expand...

Log in or Sign up

Research exposes vulnerabilities in IP camera firmware used by multiple vendors

guest Guest

Log in or Sign up

Research exposes vulnerabilities in IP camera firmware used by multiple vendors

guest Guest

Useful Searches