Camtron CMNC-200 IP Camera - Undocumented Default Accounts

2010-11-13T00:00:00
ID EXPLOITPACK:5D21D9F9CC6F1B5A7E99A927EDF93E0B
Type exploitpack
Reporter Trustwaves SpiderLabs
Modified 2010-11-13T00:00:00

Description

Camtron CMNC-200 IP Camera - Undocumented Default Accounts

                                        
                                            Finding 4: Undocumented Default Accounts
CVE: CVE-2010-4233

The CMNC-200 IP Camera has undocumented default
accounts on its Linux operating system. These accounts can
be used to login via the cameras telnet interface, which
cannot be normally disabled. The usernames and passwords are
listed below.

User: root     Password: m
User: mg3500   Password: merlin

Vendor Response:
No response received.

Remediation Steps:
No patch currently exists for this issue. To limit exposure,
network access to these devices should be limited to authorized
personnel through the use of Access Control Lists and proper
network segmentation.