CVE-2017-8415 Hardcoded credentials in n/a
Attackers can gain administrative access to D-Link cameras using a hardcoded password stored in a read-only filesystem.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2017-8415?
CVE-2017-8415 is a critical vulnerability in n/a, published on 2 Jul 2019. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
An issue was discovered on D-Link DCS-1100 and DCS-1130 devices. The device has a custom telnet daemon as a part of the busybox and retrieves the password from the shadow file using the function getspnam at address 0x00053894. Then performs a crypt operation on the password retrieved from the user at address 0x000538E0 and performs a strcmp at address 0x00053908 to check if the password is correct or incorrect. However, the /etc/shadow file is a part of CRAM-FS filesystem which means that the user cannot change the password and hence a hardcoded hash in /etc/shadow is used to match the credentials provided by the user. This is a salted hash of the string "admin" and hence it acts as a password to the device which cannot be changed as the whole filesystem is read only.
Weakness: CWE-798
Which versions are affected by CVE-2017-8415?
It affects 2 products.
Products include Dlink Dcs-1100 Firmware, Dlink Dcs-1130 Firmware.
How do I fix CVE-2017-8415?
No fix has been published for CVE-2017-8415 yet. Limit exposure of the affected software until one is available.
Is CVE-2017-8415 being exploited?
There is no known exploitation of CVE-2017-8415 in the wild and no public exploit code.
Other vulnerabilities in n/a
Sources
Also known as GHSA-3qrh-88fr-gvx6.