CVE-2017-11632
📋 TL;DR
This vulnerability affects Wireless IP Camera 360 devices that have a hardcoded root account with a known SHA-512 password hash. Remote attackers can exploit this via TELNET to gain full administrative control over the camera. All users of affected Wireless IP Camera 360 models are at risk.
💻 Affected Systems
- Wireless IP Camera 360 devices
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete compromise of camera system allowing attackers to view/record video feeds, disable security functions, pivot to internal networks, or use device as botnet node.
Likely Case
Unauthorized access to camera feeds and device control, potential privacy violations, and device hijacking for malicious purposes.
If Mitigated
Limited impact if TELNET is disabled and cameras are isolated on separate network segments with strict firewall rules.
🎯 Exploit Status
Exploitation requires only TELNET access and knowledge of the hardcoded hash. Scripts and tools exist to automate this attack.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: No official vendor advisory found
Restart Required: No
Instructions:
1. Check manufacturer website for firmware updates
2. If available, download latest firmware
3. Follow manufacturer instructions to flash firmware
4. Verify TELNET is disabled after update
🔧 Temporary Workarounds
Disable TELNET service
linuxCompletely disable TELNET access to prevent exploitation
telnetd -l /bin/sh -p 23 & (to check if running)
killall telnetd
Remove telnetd from startup scripts
Change root password
linuxChange the root password to prevent hash-based authentication
passwd root
🧯 If You Can't Patch
- Isolate cameras on separate VLAN with strict firewall rules blocking all inbound TELNET traffic
- Implement network segmentation to prevent lateral movement from compromised cameras
🔍 How to Verify
Check if Vulnerable:
Attempt TELNET connection to camera port 23 and try known root credentials or hash. Check if telnetd process is running: ps aux | grep telnetdCheck Version:
Check device web interface or use manufacturer-specific commands (varies by model)Verify Fix Applied:
Verify TELNET service is not running and cannot be accessed. Test authentication with old credentials fails.📡 Detection & Monitoring
Log Indicators:
- Failed/successful TELNET authentication attempts
- Multiple TELNET connection attempts from unusual IPs
- Root login via TELNET
Network Indicators:
- TELNET traffic to camera devices
- Unusual outbound connections from cameras
- Port 23 scans targeting camera IPs
SIEM Query:
source="camera_logs" AND (event="telnet" OR port=23) AND (user="root" OR auth_failure)