CVE-2017-8229
📋 TL;DR
CVE-2017-8229 allows unauthenticated attackers to download administrative credentials from Amcrest IPM-721S cameras by accessing configuration files via a web URL. This affects devices running specific vulnerable firmware versions, enabling complete device compromise.
💻 Affected Systems
- Amcrest IPM-721S
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Full device takeover, credential theft, camera control hijacking, network pivoting, and persistent backdoor installation.
Likely Case
Administrative credential theft leading to unauthorized camera access, video feed interception, and device configuration changes.
If Mitigated
Limited impact if device is isolated behind firewalls with strict network segmentation and credential rotation.
🎯 Exploit Status
Simple HTTP GET request to /current_config/Sha1Account1 or similar paths. Public exploit scripts and detailed analysis available.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Later firmware versions (specific version not documented in CVE)
Vendor Advisory: No official vendor advisory found in references
Restart Required: Yes
Instructions:
1. Check current firmware version via web interface. 2. Download latest firmware from Amcrest support site. 3. Upload via web interface. 4. Reboot device after update.
🔧 Temporary Workarounds
Network Isolation
linuxBlock external access to camera web interface
iptables -A INPUT -p tcp --dport 80 -j DROP
iptables -A INPUT -p tcp --dport 443 -j DROP
Access Control Restriction
linuxRestrict web interface access to specific IP addresses
iptables -A INPUT -p tcp --dport 80 -s 192.168.1.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 80 -j DROP
🧯 If You Can't Patch
- Isolate device on separate VLAN with no internet access
- Change all credentials and monitor for unauthorized access attempts
🔍 How to Verify
Check if Vulnerable:
curl -v http://[camera-ip]/current_config/Sha1Account1 - if returns credential file without authentication, device is vulnerableCheck Version:
Check web interface System Information page or via SNMP if enabledVerify Fix Applied:
Attempt same curl command - should return 401/403 error or require authentication after patch📡 Detection & Monitoring
Log Indicators:
- Unauthenticated access to /current_config/* paths in web logs
- Multiple failed login attempts followed by successful access
Network Indicators:
- HTTP GET requests to /current_config/Sha1Account1 from unauthorized IPs
- Unusual outbound connections from camera
SIEM Query:
source="camera_web_logs" AND uri_path="/current_config/*" AND auth_status="unauthenticated"🔗 References
- http://packetstormsecurity.com/files/153224/Amcrest-IPM-721S-Credential-Disclosure-Privilege-Escalation.html
- https://github.com/ethanhunnt/IoT_vulnerabilities/blob/master/Amcrest_sec_issues.pdf
- https://seclists.org/bugtraq/2019/Jun/8
- http://packetstormsecurity.com/files/153224/Amcrest-IPM-721S-Credential-Disclosure-Privilege-Escalation.html
- https://github.com/ethanhunnt/IoT_vulnerabilities/blob/master/Amcrest_sec_issues.pdf
- https://seclists.org/bugtraq/2019/Jun/8
