CVE-2017-17107
📋 TL;DR
This vulnerability allows attackers to gain root access to Zivif PR115-204-P-RS web cameras via TELNET using a hard-coded password 'cat1029' that cannot be changed. The SONIX operating system's design makes this password permanent, enabling complete device compromise. All users of affected camera models are vulnerable.
💻 Affected Systems
- Zivif PR115-204-P-RS web camera
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Attackers gain full root control of the camera, enabling them to disable security features, install malware, use the device as a botnet node, access video feeds, and pivot to other network devices.
Likely Case
Remote attackers exploit the hard-coded credentials to access the camera, potentially viewing or manipulating video streams, changing device settings, and using it for further attacks.
If Mitigated
With proper network segmentation and access controls, impact is limited to the camera device itself without allowing lateral movement to other systems.
🎯 Exploit Status
Exploitation requires only TELNET access and knowledge of the hard-coded password 'cat1029'. Public exploit code and detailed instructions are available.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: No vendor advisory found
Restart Required: No
Instructions:
No official patch available. Consider replacing affected devices with models from vendors that provide security updates.
🔧 Temporary Workarounds
Disable TELNET service
linuxRemove or disable the TELNET service to prevent remote exploitation of the hard-coded credentials.
telnetd -l /bin/sh &
killall telnetd
rm /usr/sbin/telnetd
Network segmentation and firewall rules
allIsolate cameras on separate VLANs and block all inbound TELNET traffic (port 23) to camera devices.
iptables -A INPUT -p tcp --dport 23 -j DROP
🧯 If You Can't Patch
- Physically disconnect cameras from networks or place them behind strict firewalls with no inbound internet access
- Replace affected cameras with models from vendors that provide security updates and patch support
🔍 How to Verify
Check if Vulnerable:
Attempt TELNET connection to camera on port 23 and use username 'root' with password 'cat1029'. If login succeeds, device is vulnerable.Check Version:
Check device web interface or use command: cat /proc/versionVerify Fix Applied:
After applying workarounds, attempt TELNET connection should fail or service should be unavailable.📡 Detection & Monitoring
Log Indicators:
- Failed or successful TELNET authentication attempts
- Unusual root login activity
- TELNET service restart logs
Network Indicators:
- TELNET traffic (port 23) to camera devices
- Unusual outbound connections from camera devices
SIEM Query:
source_port=23 OR destination_port=23 AND (event_type="authentication" OR event_type="login")🔗 References
- http://packetstormsecurity.com/files/145386/Zivif-PR115-204-P-RS-2.3.4.2103-Bypass-Command-Injection-Hardcoded-Password.html
- http://seclists.org/fulldisclosure/2017/Dec/42
- https://twitter.com/silascutler/status/938052460328968192
- http://packetstormsecurity.com/files/145386/Zivif-PR115-204-P-RS-2.3.4.2103-Bypass-Command-Injection-Hardcoded-Password.html
- http://seclists.org/fulldisclosure/2017/Dec/42
- https://twitter.com/silascutler/status/938052460328968192
