CVE-2020-26097
📋 TL;DR
This CVE involves hard-coded default credentials in PLANET NVR devices that allow root access via telnet. If telnet is exposed to the Internet, attackers can gain complete control of affected devices. This vulnerability only affects products that are no longer supported by the manufacturer.
💻 Affected Systems
- PLANET Technology Corp NVR-915
- PLANET Technology Corp NVR-1615
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete compromise of the NVR system, allowing attackers to view/manipulate surveillance footage, use device as pivot point into internal networks, or deploy ransomware/malware.
Likely Case
Unauthorized access to surveillance systems, data exfiltration, or device being added to botnets for DDoS attacks.
If Mitigated
Limited to internal network access attempts if telnet is properly firewalled.
🎯 Exploit Status
Exploitation requires only telnet access and knowledge of default credentials. No authentication needed.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: N/A
Vendor Advisory: N/A
Restart Required: No
Instructions:
No official patch available as products are end-of-life. Consider replacing with supported hardware.
🔧 Temporary Workarounds
Disable Telnet Service
allCompletely disable telnet service on affected devices
Check device administration interface for telnet disable option
Change Default Credentials
linuxChange root password if device allows password modification
passwd root (if shell access available)
🧯 If You Can't Patch
- Isolate devices on separate VLAN with strict firewall rules blocking telnet (port 23) from all networks
- Implement network segmentation and ensure devices are not directly internet-facing
🔍 How to Verify
Check if Vulnerable:
Attempt telnet connection to device port 23 and try default credentials. Check device firmware version against affected range.Check Version:
Check device web interface or console for firmware version informationVerify Fix Applied:
Verify telnet service is disabled or inaccessible. Test that default credentials no longer work.📡 Detection & Monitoring
Log Indicators:
- Failed/successful telnet authentication attempts
- Multiple root login attempts via telnet
Network Indicators:
- Telnet connections to port 23 from external IPs
- Unusual outbound connections from NVR devices
SIEM Query:
source_port=23 AND (event_type="authentication" OR event_type="connection")