CVE-2018-10770
📋 TL;DR
This vulnerability allows remote attackers to download the configuration file of ShenZhen Anni '5 in 1 XVR' devices without authentication, exposing administrative passwords. It affects all users of these specific XVR devices with the vulnerable download.rsp endpoint exposed. Attackers can gain full control of the devices by obtaining credentials.
💻 Affected Systems
- ShenZhen Anni '5 in 1 XVR' devices
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete compromise of XVR device leading to surveillance system takeover, video feed interception, device manipulation, and potential lateral movement to connected networks.
Likely Case
Unauthorized access to XVR configuration, password theft, and device compromise allowing attackers to view/manipulate surveillance feeds.
If Mitigated
Limited to attempted access logs if proper network segmentation and authentication controls are implemented.
🎯 Exploit Status
Simple HTTP GET request to download.rsp endpoint retrieves configuration file containing credentials. Multiple GitHub repositories contain exploit code.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: Not found in provided references
Restart Required: No
Instructions:
No official patch available. Contact ShenZhen Anni for firmware updates or replacement recommendations.
🔧 Temporary Workarounds
Network Segmentation
allIsolate XVR devices from internet and restrict internal network access
Access Control Lists
linuxImplement firewall rules to block external access to XVR web interface
iptables -A INPUT -p tcp --dport 80 -s trusted_networks -j ACCEPT
iptables -A INPUT -p tcp --dport 80 -j DROP
🧯 If You Can't Patch
- Disable or block access to download.rsp endpoint via web server configuration if possible
- Change all device passwords immediately and implement strong password policies
🔍 How to Verify
Check if Vulnerable:
Attempt HTTP GET request to http://[device_ip]/download.rsp. If configuration file downloads without authentication, device is vulnerable.Check Version:
Check device web interface or physical label for firmware version. No standard command available.Verify Fix Applied:
Verify download.rsp endpoint requires authentication or returns error when accessed without credentials.📡 Detection & Monitoring
Log Indicators:
- HTTP GET requests to /download.rsp from unauthorized IPs
- Multiple failed login attempts followed by configuration download
Network Indicators:
- Unusual outbound connections from XVR devices
- HTTP requests to download.rsp from external IPs
SIEM Query:
sourceIP=external AND destinationPort=80 AND urlPath="/download.rsp"