CVE-2017-7648 Hardcoded credentials in n/a
Remote attackers can defeat cryptographic protections on Foscam devices by using a shared hardcoded SSL private key found in other installations.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2017-7648?
CVE-2017-7648 is a high-severity vulnerability in n/a, published on 10 Apr 2017. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Foscam networked devices use the same hardcoded SSL private key across different customers' installations, which allows remote attackers to defeat cryptographic protection mechanisms by leveraging knowledge of this key from another installation.
Weakness: CWE-798
Which versions are affected by CVE-2017-7648?
It affects 12 products.
Products include Foscam C1, Foscam C1 Lite, Foscam C2, Foscam Fi9800xe, Foscam Fi9826p, Foscam Fi9828p and 6 more.
How do I fix CVE-2017-7648?
No fix has been published for CVE-2017-7648 yet. Limit exposure of the affected software until one is available.
Is CVE-2017-7648 being exploited?
There is no known exploitation of CVE-2017-7648 in the wild and no public exploit code.
Public exploit code: 1 proofs of concept on GitHub.
Sources
Also known as GHSA-x9p4-3x2x-qpvx.