CVE-2016-2359
📋 TL;DR
Milesight IP security cameras contain an authentication bypass vulnerability that allows remote attackers to access protected resources without credentials by simultaneously requesting an unprotected vb.htm resource. This affects Milesight IP security cameras manufactured through November 14, 2016. Attackers can gain unauthorized access to camera feeds and administrative functions.
💻 Affected Systems
- Milesight IP security cameras
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete compromise of camera system allowing unauthorized video surveillance, camera manipulation, and potential network pivoting to internal systems.
Likely Case
Unauthorized access to live camera feeds, recorded footage, and camera configuration settings.
If Mitigated
Limited impact if cameras are isolated on separate VLANs with strict network segmentation and access controls.
🎯 Exploit Status
Exploitation requires simultaneous requests to protected and unprotected resources, but tools exist to automate this. Public demonstrations show successful exploitation.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Firmware after 2016-11-14
Vendor Advisory: No official vendor advisory found in references
Restart Required: Yes
Instructions:
1. Check current firmware version. 2. Download latest firmware from Milesight support. 3. Upload firmware via web interface. 4. Reboot camera after update completes.
🔧 Temporary Workarounds
Network segmentation
allIsolate cameras on separate VLAN with strict firewall rules blocking external access to camera web interface.
Disable web interface
allDisable HTTP/HTTPS web management interface if not required for operations.
🧯 If You Can't Patch
- Place cameras behind VPN with strict authentication requirements
- Implement network monitoring for unusual access patterns to camera web interfaces
🔍 How to Verify
Check if Vulnerable:
Test by making simultaneous requests to protected resource and vb.htm endpoint. If protected resource returns data without authentication, system is vulnerable.Check Version:
Check firmware version in camera web interface under System > Information or via SNMP if enabled.Verify Fix Applied:
Attempt the same simultaneous request test after patching. Protected resources should require proper authentication.📡 Detection & Monitoring
Log Indicators:
- Multiple simultaneous requests from same IP to /vb.htm and protected endpoints
- Access to protected resources without prior authentication logs
Network Indicators:
- Unusual spike in HTTP requests to camera IPs
- Requests to /vb.htm followed immediately by access to protected resources
SIEM Query:
source_ip="CAMERA_IP" AND (uri="/vb.htm" OR uri="/protected_resource") | stats count by source_ip, uri🔗 References
- http://kirils.org/slides/2016-10-06_Milesight_initial.pdf
- https://possiblesecurity.com/news/vulnerabilities-of-milesight-ip-security-cameras/
- https://www.youtube.com/watch?v=scckkI7CAW0
- http://kirils.org/slides/2016-10-06_Milesight_initial.pdf
- https://possiblesecurity.com/news/vulnerabilities-of-milesight-ip-security-cameras/
- https://www.youtube.com/watch?v=scckkI7CAW0
