PT-2018-16302 · Yi · Yi Home Camera

Name of the Vulnerable Software and Affected Versions: Yi Home Camera 27US version 1.8.7.0D Description: An exploitable code execution issue exists in the cloud OTA setup functionality. A specially crafted SSID can cause a command injection, resulting in code execution. An attacker can trigger th...

PT-2018-16339 · Yi · Yi Home Camera

Name of the Vulnerable Software and Affected Versions: Yi Home Camera version 1.8.7.0D Description: An exploitable information disclosure issue exists in the phone-to-camera communications. An attacker can exploit this by sniffing network traffic. Recommendations: For version 1.8.7.0D, at the...

PT-2018-16320 · Yi · Yi Home Camera

Name of the Vulnerable Software and Affected Versions: Yi Home Camera version 1.8.7.0D Description: An exploitable code execution issue exists in the firmware update functionality. A specially crafted set of UDP packets can cause a settings change, resulting in denial of service. An attacker can...

Apple's New MacBook Disconnects Microphone "Physically" When Lid is Closed

Apple introduces a new privacy feature for all new MacBooks that "at some extent" will prevent hackers and malicious applications from eavesdropping on your conversations. Apple's custom T2 security chip in the latest MacBooks includes a new hardware feature that physically disconnects the...

Apple's New MacBook Disconnects Microphone "Physically" When Lid is Closed

Apple introduces a new privacy feature for all new MacBooks that "at some extent" will prevent hackers and malicious applications from eavesdropping on your conversations. Apple's custom T2 security chip in the latest MacBooks includes a new hardware feature that physically disconnects the...

Vulnerability Spotlight: Multiple Vulnerabilities in Yi Technology Home Camera

Vulnerabilities Discovered by Lilith xx of Cisco Talos. Overview Cisco Talos is disclosing multiple vulnerabilities in the firmware of the Yi Technology Home Camera. In order to prevent the exploitation of these vulnerabilities, Talos worked with Yi Technology to make sure a newer version of the...

Ghost hardware. Device No.1, the Ghost Pro

Colloquially known as a “Ghost Pro” this full spectrum camera is supposed to allow you to see beyond the visible spectrum, into the infrared and ultraviolet ranges. This one has Wi-Fi as well, for ease of remote control. There’s a few questions we wanted to answer with this one. Who’s the camera...

Yi Technology Home Camera 27US Firmware Downgrade Vulnerability

Summary An exploitable firmware downgrade vulnerability exists in the firmware update functionality of Yi Home Camera 27US 1.8.7.0D. A specially crafted file can cause a logic flaw, resulting in a firmware downgrade. An attacker can insert an SD card to trigger this vulnerability. Tested Versions...

Yi Technology Home Camera 27US notice_to denial-of-service vulnerability

Summary An exploitable code execution vulnerability exists in the firmware update functionality of Yi Home Camera 27US 1.8.7.0D. A specially crafted set of UDP packets can cause a settings change, resulting in denial of service. An attacker can send a set of packets to trigger this vulnerability...

Yi Technology Home Camera 27US Firmware 7z CRC Collision Vulnerability

Summary An exploitable code execution vulnerability exists in the firmware update functionality of the Yi Home Camera 27US 1.8.7.0D. A specially crafted 7-Zip file can cause a CRC collision, resulting in a firmware update and code execution. An attacker can insert an SDcard to trigger this...

Yi Technology Home Camera 27US cloudAPI SSID Code Execution Vulnerability

Summary An exploitable code execution vulnerability exists in the cloud OTA setup functionality of Yi Home Camera 27US 1.8.7.0D. A specially crafted SSID can cause a command injection, resulting in code execution. An attacker can cause a camera to connect to this SSID to trigger this vulnerabilit...

Yi Technology Home Camera 27US Firmware Update Code Execution Vulnerability

Summary An exploitable code execution vulnerability exists in the firmware update functionality of Yi Home Camera 27US 1.8.7.0D. A specially crafted file can cause a logic flaw and command injection, resulting in code execution. An attacker can insert an SD card to trigger this vulnerability...

Yi Technology Home Camera 27US CRCDec denial-of-service vulnerability

Summary An exploitable code execution vulnerability exists in the UDP network functionality of Yi Home Camera 27US 1.8.7.0D. A specially crafted set of UDP packets can allocate unlimited memory, resulting in denial of service. An attacker can send a set of packets to trigger this vulnerability...

Yi Technology Home Camera 27US nonce reuse authentication bypass vulnerability

Summary An exploitable code execution vulnerability exists in the firmware update functionality of Yi Home Camera 27US 1.8.7.0D. A specially crafted set of UDP packets can cause a logic flaw, resulting in an authentication bypass. An attacker can sniff network traffic and send a set of packets to...

Yi Technology Home Camera 27US QR Code Base64 Code Execution Vulnerability

Summary An exploitable code execution vulnerability exists in the QR code scanning functionality of Yi Home Camera 27US 1.8.7.0D. A specially crafted QR Code can cause a buffer overflow, resulting in code execution. An attacker can make the camera scan a QR code to trigger this vulnerability...

Hikvision IP Camera Default Credentials (HTTP)

The remote Hikvision IP camera device is using known default credentials. Copyright C 2018 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is fr...

SV3C L-SERIES HD CAMERA Cross-Site Scripting Vulnerability

SV3C L-SERIES HD CAMERA is a webcam product from SV3C Technology, China. A cross-site scripting vulnerability exists in SV3C L-SERIES HD CAMERA version V2.3.4.2103-S50-NTD-B20170508B, which originates from the program failing to properly validate user-submitted input. The vulnerability can be...

SV3C L-SERIES HD CAMERA Information Disclosure Vulnerability

SV3C L-SERIES HD CAMERA is a webcam product from SV3C Technology, China. A security vulnerability exists in SV3C L-SERIES HD CAMERA version V2.3.4.2103-S50-NTD-B20170508B and version V2.3.4.2103-S50-NTD-B20170823B, which originates from a program that passes sensitive information in clear text. A...

SV3C L-SERIES HD CAMERA OS Command Injection Vulnerability

SV3C L-SERIES HD CAMERA is a webcam product from SV3C Technology, China. An operating system command injection vulnerability exists in versions V2.3.4.2103-S50-NTD-B20170508B and V2.3.4.2103-S50-NTD-B20170823B of the SV3C L-SERIES HD CAMERA, which stems from the program failing to detect user...

Input validation

Missing authentication and improper input validation in KERUI Wifi Endoscope Camera YPC99 allow an attacker to execute arbitrary commands with a length limit of 19 characters via the "ssid" value, as demonstrated by ssid:;ping 192.168.1.2 in the body of a SETSSID command...