Vulnerability Details : CVE-2017-17107
Potential exploit
Zivif PR115-204-P-RS V2.3.4.2103 web cameras contain a hard-coded cat1029 password for the root user. The SONIX operating system's setup renders this password unchangeable and it can be used to access the device via a TELNET session.
Products affected by CVE-2017-17107
- cpe:2.3:o:zivif:pr115-204-p-rs_firmware:2.3.4.2103:*:*:*:*:*:*:*
Exploit prediction scoring system (EPSS) score for CVE-2017-17107
2.59%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 90 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2017-17107
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
|---|---|---|---|---|---|---|
|
10.0
|
HIGH | AV:N/AC:L/Au:N/C:C/I:C/A:C |
10.0
|
10.0
|
NIST | |
|
9.8
|
CRITICAL | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
3.9
|
5.9
|
NIST |
CWE ids for CVE-2017-17107
-
The product contains hard-coded credentials, such as a password or cryptographic key.Assigned by: nvd@nist.gov (Primary)
References for CVE-2017-17107
-
http://seclists.org/fulldisclosure/2017/Dec/42
Full Disclosure: Three exploits for Zivif Web Cameras (may impact others)Exploit;Mailing List;Third Party Advisory
-
https://twitter.com/silascutler/status/938052460328968192
Silas Cutler on Twitter: "Fun note. #LaCaja from @Hackerstrip is my disclosure for CVE-2017-17105, CVE-2017-17106, and CVE-2017-17107."Third Party Advisory
-
http://packetstormsecurity.com/files/145386/Zivif-PR115-204-P-RS-2.3.4.2103-Bypass-Command-Injection-Hardcoded-Password.html
Zivif PR115-204-P-RS 2.3.4.2103 Bypass / Command Injection / Hardcoded Password ≈ Packet StormExploit;Third Party Advisory;VDB Entry
Jump to