CVE-2017-17761
📋 TL;DR
CVE-2017-17761 is a critical remote code execution vulnerability in Ichano AtHome IP Camera devices. It allows unauthenticated attackers on the same network to execute arbitrary commands via the 'noodles' service on port 1300. This affects all users of vulnerable Ichano AtHome IP Camera models.
💻 Affected Systems
- Ichano AtHome IP Camera devices
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete device compromise allowing attackers to install persistent malware, pivot to other network devices, disable cameras, or use devices in botnets.
Likely Case
Attackers gain full control of cameras to disable surveillance, steal video feeds, or use devices for cryptocurrency mining or DDoS attacks.
If Mitigated
Limited impact if cameras are isolated on separate VLANs with strict network segmentation and access controls.
🎯 Exploit Status
Exploitation is trivial - attackers simply send XML commands with <system> tags to port 1300. Multiple public exploit scripts exist.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: No official vendor advisory found
Restart Required: No
Instructions:
No official patch available. Consider replacing affected devices with models from vendors that provide security updates.
🔧 Temporary Workarounds
Block port 1300 at network perimeter
linuxPrevent external access to the vulnerable service by blocking TCP port 1300 at firewalls.
iptables -A INPUT -p tcp --dport 1300 -j DROP
iptables -A OUTPUT -p tcp --dport 1300 -j DROP
Network segmentation
allIsolate IP cameras on separate VLANs with strict access controls to prevent lateral movement.
🧯 If You Can't Patch
- Immediately disconnect affected cameras from internet access
- Place cameras on isolated network segments with no access to critical systems
🔍 How to Verify
Check if Vulnerable:
Test if port 1300 is open and responds to XML commands: echo '<system>id</system>' | nc <camera_ip> 1300Check Version:
No standard version check command available for these embedded devicesVerify Fix Applied:
Verify port 1300 is no longer accessible or returns error when sending XML commands📡 Detection & Monitoring
Log Indicators:
- Unusual network connections to port 1300
- Unexpected system command executions on camera devices
Network Indicators:
- XML traffic to port 1300 containing <system> tags
- Outbound connections from cameras to suspicious IPs
SIEM Query:
source_port:1300 OR dest_port:1300 AND (xml OR system)