TWSL2010-006: Multiple Vulnerabilities in Camtron CMNC-200 IP Camera

Trustwave's SpiderLabs Security Advisory TWSL2010-006: Multiple Vulnerabilities in Camtron CMNC-200 IP Camera https://www.trustwave.com/spiderlabs/advisories/TWSL2010-006.txt Published: 2010-11-12 Version: 1.0 Vendors: Camtron http://www.camtron.co.kr/ TecVoz http://www.tecvoz.com.br/ Products:...

CVE-2010-4230

Stack-based buffer overflow in a certain ActiveX control for the Camtron CMNC-200 Full HD IP Camera and TecVoz CMNC-200 Megapixel IP Camera with firmware 1.102A-008 allows remote attackers to execute arbitrary code via a long string in the first argument to the connect method...

CVE-2010-4233

The Linux installation on the Camtron CMNC-200 Full HD IP Camera and TecVoz CMNC-200 Megapixel IP Camera with firmware 1.102A-008 has a default password of m for the root account, and a default password of merlin for the mg3500 account, which makes it easier for remote attackers to obtain access...

Code injection

The web server on the Camtron CMNC-200 Full HD IP Camera and TecVoz CMNC-200 Megapixel IP Camera with firmware 1.102A-008 allows remote attackers to cause a denial of service device reboot via a large number of requests in a short time interval...

CVE-2010-4230

The CVE-2010-4230 issue affects the Camtron CMNC-200 Full HD IP Camera and TecVoz CMNC-200 Megapixel IP Camera (firmware 1.102A-008) via a stack-based buffer overflow in an installable ActiveX control. The vulnerability lies in the first argument to the connect method of the ActiveX object (CLSID...

CVE-2010-4232

The web-based administration interface on the Camtron CMNC-200 Full HD IP Camera and TecVoz CMNC-200 Megapixel IP Camera with firmware 1.102A-008 allows remote attackers to bypass authentication via a // slash slash at the beginning of a URI, as demonstrated by the //system.html URI...

CVE-2010-4230

Stack-based buffer overflow in a certain ActiveX control for the Camtron CMNC-200 Full HD IP Camera and TecVoz CMNC-200 Megapixel IP Camera with firmware 1.102A-008 allows remote attackers to execute arbitrary code via a long string in the first argument to the connect method...

CVE-2010-4233

The Linux installation on the Camtron CMNC-200 Full HD IP Camera and TecVoz CMNC-200 Megapixel IP Camera with firmware 1.102A-008 has a default password of m for the root account, and a default password of merlin for the mg3500 account, which makes it easier for remote attackers to obtain access...

Camtron CMNC-200 IP Camera Denial of Service

Exploit for hardware platform in category dos / poc ============================================ Camtron CMNC-200 IP Camera Denial of Service ============================================ The CMNC-200 IP Camera has a built-in web server that is vulnerable to denial of service attacks. Sending...

Camtron CMNC-200 IP Camera Authentication Bypass

Exploit for hardware platform in category web applications ================================================ Camtron CMNC-200 IP Camera Authentication Bypass ================================================ The CMNC-200 IP Camera has an administrative web interface that does not handle...

Camtron CMNC-200 IP Camera Undocumented Default Accounts

Exploit for hardware platform in category web applications ======================================================== Camtron CMNC-200 IP Camera Undocumented Default Accounts ======================================================== The CMNC-200 IP Camera has undocumented default accounts on its Lin...

Camtron CMNC-200 IP Camera Directory Traversal Vulnerability

Exploit for hardware platform in category remote exploits ============================================================ Camtron CMNC-200 IP Camera Directory Traversal Vulnerability ============================================================ The CMNC-200 IP Camera has a built-in web server that is...

Camtron CMNC-200 IP Camera - Denial of Service

Camtron CMNC-200 IP Camera - Denial of Service Finding 5: Camera Denial of Service CVE: CVE-2010-4234 The CMNC-200 IP Camera has a built-in web server that is vulnerable to denial of service attacks. Sending multiple requests in parallel to the web server may cause the camera to reboot. Requests...

Camtron CMNC-200 IP Camera - Directory Traversal

Camtron CMNC-200 IP Camera - Directory Traversal Finding 2: Directory Traversal in Camera Web Server CVE: CVE-2010-4231 The CMNC-200 IP Camera has a built-in web server that is enabled by default. The server is vulnerable to directory transversal attacks, allowing access to any file on the camera...

Camtron CMNC-200 IP Camera - ActiveX Buffer Overflow

Finding 1: Buffer Overflow in ActiveX Control CVE: CVE-2010-4230 The CMNC-200 IP Camera ActiveX control identified by CLSID DD01C8CA-5DA0-4B01-9603-B7194E561D32 is vulnerable to a stack overflow on the first argument of the connect method. The vulnerability can be used to set the EIP register,...

Camtron CMNC-200 IP Camera - Undocumented Default Accounts

Camtron CMNC-200 IP Camera - Undocumented Default Accounts Finding 4: Undocumented Default Accounts CVE: CVE-2010-4233 The CMNC-200 IP Camera has undocumented default accounts on its Linux operating system. These accounts can be used to login via the cameras telnet interface, which cannot be...

Camtron CMNC-200 IP Camera - Authentication Bypass

Finding 3: Web Based Administration Interface Bypass CVE: CVE-2010-4232 The CMNC-200 IP Camera has an administrative web interface that does not handle authentication properly. Using a properly formatted request, an attacker can bypass the authentication mechanism. The first example requires...

Camtron CMNC-200 IP Camera - Undocumented Default Accounts

Finding 4: Undocumented Default Accounts CVE: CVE-2010-4233 The CMNC-200 IP Camera has undocumented default accounts on its Linux operating system. These accounts can be used to login via the cameras telnet interface, which cannot be normally disabled. The usernames and passwords are listed below...

Camtron CMNC-200 IP Camera - ActiveX Buffer Overflow

Camtron CMNC-200 IP Camera - ActiveX Buffer Overflow Finding 1: Buffer Overflow in ActiveX Control CVE: CVE-2010-4230 The CMNC-200 IP Camera ActiveX control identified by CLSID DD01C8CA-5DA0-4B01-9603-B7194E561D32 is vulnerable to a stack overflow on the first argument of the connect method. The...

Camtron CMNC-200 IP Camera - Authentication Bypass

Camtron CMNC-200 IP Camera - Authentication Bypass Finding 3: Web Based Administration Interface Bypass CVE: CVE-2010-4232 The CMNC-200 IP Camera has an administrative web interface that does not handle authentication properly. Using a properly formatted request, an attacker can bypass the...