CVE-2018-16546 Hardcoded credentials in n/a
Remote attackers can defeat cryptographic protections on Amcrest devices by using a shared hardcoded SSL private key found in other installations.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2018-16546?
CVE-2018-16546 is a medium-severity vulnerability in n/a, published on 5 Sep 2018. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Amcrest networked devices use the same hardcoded SSL private key across different customers' installations, which allows remote attackers to defeat cryptographic protection mechanisms by leveraging knowledge of this key from another installation, as demonstrated by Amcrest_IPC-HX1X3X-LEXUS_Eng_N_AMCREST_V2.420.AC01.3.R.20180206.
Weakness: CWE-798
Which versions are affected by CVE-2018-16546?
It affects 1 product.
Products include Amcrest Amcrest Ipc-Hx1x3x-Lexus Eng N Amcrest.
How do I fix CVE-2018-16546?
No fix has been published for CVE-2018-16546 yet. Limit exposure of the affected software until one is available.
Is CVE-2018-16546 being exploited?
There is no known exploitation of CVE-2018-16546 in the wild and no public exploit code.
Sources
Also known as GHSA-c5gc-77wf-jm29.