CVE-2021-25847
📋 TL;DR
This vulnerability in Moxa VPort 06EC-2V Series IP cameras allows attackers to disclose sensitive information by sending specially crafted LLDP packets. Attackers can exploit improper validation of LLDP-MED TLV length fields to read memory contents. Only version 1.1 of these specific Moxa cameras is affected.
💻 Affected Systems
- Moxa Camera VPort 06EC-2V Series
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete memory disclosure including credentials, configuration data, and potentially camera feed access
Likely Case
Information disclosure of sensitive camera configuration and network data
If Mitigated
Limited impact with proper network segmentation and monitoring
🎯 Exploit Status
Exploitation requires sending crafted LLDP packets to the camera's network interface
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Version 1.2 or later
Vendor Advisory: https://www.moxa.com/en/support/product-support/security-advisory/vport-06ec-2v-series-ip-cameras-vulnerabilities
Restart Required: Yes
Instructions:
1. Download firmware version 1.2 or later from Moxa support site. 2. Upload firmware via web interface. 3. Reboot camera after installation.
🔧 Temporary Workarounds
Disable LLDP
linuxDisable the LLDP service on affected cameras
ssh admin@camera-ip
systemctl stop vport_lldpd
systemctl disable vport_lldpd
Network Segmentation
allIsolate cameras on separate VLAN with strict firewall rules
🧯 If You Can't Patch
- Segment cameras on isolated network with strict firewall rules blocking LLDP traffic (UDP port 3780)
- Implement network monitoring for anomalous LLDP packets targeting cameras
🔍 How to Verify
Check if Vulnerable:
Check camera firmware version via web interface or SSH: cat /etc/versionCheck Version:
cat /etc/versionVerify Fix Applied:
Verify firmware version is 1.2 or higher and LLDP service is either updated or disabled📡 Detection & Monitoring
Log Indicators:
- Unusual LLDP packet sizes or malformed LLDP traffic in network logs
- Memory access errors in camera system logs
Network Indicators:
- LLDP packets with abnormal TLV lengths sent to camera IPs
- Unexpected outbound traffic from cameras after LLDP reception
SIEM Query:
source_ip=* AND dest_port=3780 AND packet_size>1500