CVE-2021-29255
📋 TL;DR
MicroSeven MYM71080i-B devices transmit admin credentials in cleartext to a remote server, allowing attackers on the same network to intercept and capture these credentials. This affects all users of MicroSeven MYM71080i-B devices running vulnerable firmware versions.
💻 Affected Systems
- MicroSeven MYM71080i-B
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Attackers gain administrative access to the device, potentially compromising the entire surveillance system, accessing live feeds, modifying settings, or using the device as a foothold for further network attacks.
Likely Case
Attackers capture admin credentials and gain unauthorized access to the surveillance system, potentially viewing or manipulating camera feeds and device settings.
If Mitigated
With proper network segmentation and monitoring, credential capture can be detected and prevented before exploitation occurs.
🎯 Exploit Status
Attack requires network access but no authentication; simple packet capture tools can intercept credentials
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Versions after 2.0.20
Vendor Advisory: https://blog.microseven.com
Restart Required: Yes
Instructions:
1. Log into device admin interface
2. Navigate to firmware update section
3. Download and install firmware version newer than 2.0.20
4. Reboot device after installation
🔧 Temporary Workarounds
Network Segmentation
allIsolate MicroSeven devices on separate VLAN to prevent credential capture from general network traffic
Firewall Block
linuxBlock outbound connections to pnp.microseven.com TCP port 7007 at network perimeter
iptables -A OUTPUT -p tcp --dport 7007 -d pnp.microseven.com -j DROP
🧯 If You Can't Patch
- Physically isolate device network from untrusted systems
- Implement strict network monitoring for traffic to pnp.microseven.com:7007
🔍 How to Verify
Check if Vulnerable:
Use network monitoring tools (Wireshark, tcpdump) to capture traffic from device and check for cleartext credentials sent to pnp.microseven.com:7007Check Version:
Check firmware version in device web interface under System InformationVerify Fix Applied:
After patching, verify no cleartext credentials are transmitted to pnp.microseven.com:7007 using network monitoring📡 Detection & Monitoring
Log Indicators:
- Failed login attempts from unexpected IPs
- Configuration changes from unknown sources
Network Indicators:
- Outbound connections to pnp.microseven.com:7007 containing credential strings
- Unusual admin login patterns
SIEM Query:
destination_ip='pnp.microseven.com' AND destination_port=7007 AND protocol='TCP'