CVE-2016-2357
📋 TL;DR
Milesight IP security cameras contain a hardcoded SSL private key, allowing attackers to decrypt encrypted traffic and potentially impersonate legitimate devices. This affects all Milesight IP cameras manufactured before November 14, 2016.
💻 Affected Systems
- Milesight IP security cameras
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete compromise of camera systems, allowing attackers to intercept video feeds, inject malicious content, pivot to internal networks, and disable security monitoring.
Likely Case
Interception of video streams and camera credentials, enabling unauthorized surveillance and potential access to connected networks.
If Mitigated
Limited impact if cameras are isolated in separate VLANs with strict network segmentation and no internet exposure.
🎯 Exploit Status
Attack requires network access to camera but no authentication. The hardcoded key is publicly documented.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: Not available
Restart Required: No
Instructions:
Contact Milesight for firmware updates. Replace affected cameras with newer models manufactured after 2016-11-14.
🔧 Temporary Workarounds
Network Segmentation
allIsolate cameras in separate VLAN with strict firewall rules preventing internet access and limiting internal communication.
VPN Tunnel
allRoute all camera traffic through encrypted VPN tunnels to prevent SSL interception.
🧯 If You Can't Patch
- Physically replace affected cameras with newer models
- Implement network monitoring for unusual SSL/TLS traffic patterns
🔍 How to Verify
Check if Vulnerable:
Check camera firmware date (pre-2016-11-14) or attempt to extract SSL key from /etc/config directory via SSH if accessible.Check Version:
Check camera web interface or serial number/manufacturing dateVerify Fix Applied:
Verify camera firmware date is after 2016-11-14 or check that SSL certificates are unique per device.📡 Detection & Monitoring
Log Indicators:
- Multiple failed SSL handshake attempts
- Unusual certificate validation errors
Network Indicators:
- SSL/TLS traffic decryption attempts
- Man-in-the-middle attacks on camera ports
SIEM Query:
source_ip=* dest_ip=camera_ip port=443 protocol=SSL alert_type='Certificate Mismatch'🔗 References
- http://kirils.org/slides/2016-10-06_Milesight_initial.pdf
- https://possiblesecurity.com/news/vulnerabilities-of-milesight-ip-security-cameras/
- https://www.youtube.com/watch?v=scckkI7CAW0
- http://kirils.org/slides/2016-10-06_Milesight_initial.pdf
- https://possiblesecurity.com/news/vulnerabilities-of-milesight-ip-security-cameras/
- https://www.youtube.com/watch?v=scckkI7CAW0
