CVE-2021-31793
📋 TL;DR
This vulnerability allows unauthenticated attackers to access live snapshots and video streams from NightOwl WDB-20-V2 doorbell cameras. The device's web server on port 80 exposes a /snapshot endpoint without authentication. All users of affected NightOwl doorbell devices are impacted.
💻 Affected Systems
- NightOwl WDB-20-V2 Doorbell
📦 What is this software?
Wdb 20 Firmware by Nightowlsp
⚠️ Risk & Real-World Impact
Worst Case
Complete surveillance compromise allowing continuous unauthorized monitoring of doorbell camera feeds, potentially enabling stalking, property surveillance, or reconnaissance for physical break-ins.
Likely Case
Unauthorized access to doorbell snapshots and video streams, compromising resident privacy and potentially revealing home occupancy patterns.
If Mitigated
Limited impact if device is behind firewall with restricted internet access, though local network access could still be exploited.
🎯 Exploit Status
Simple HTTP GET request to /snapshot endpoint. Proof-of-concept code is publicly available in GitHub gists.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: Not found
Restart Required: No
Instructions:
No official patch available. Check NightOwl website for firmware updates or contact vendor support.
🔧 Temporary Workarounds
Network Segmentation
allIsolate doorbell device on separate VLAN or network segment with restricted access.
Firewall Block
linuxBlock inbound and outbound traffic to/from doorbell device on port 80.
iptables -A INPUT -p tcp --dport 80 -j DROP
iptables -A OUTPUT -p tcp --dport 80 -j DROP
🧯 If You Can't Patch
- Disconnect device from internet and use only on isolated local network
- Physically disable or cover camera when not in use
🔍 How to Verify
Check if Vulnerable:
Attempt HTTP GET request to http://[doorbell-ip]/snapshot. If it returns a camera snapshot without authentication, device is vulnerable.Check Version:
Check device web interface or mobile app for firmware version information.Verify Fix Applied:
Same check should return authentication error or 404 after mitigation.📡 Detection & Monitoring
Log Indicators:
- Unusual HTTP GET requests to /snapshot endpoint from unauthorized IPs
- Multiple failed authentication attempts followed by /snapshot access
Network Indicators:
- HTTP traffic to port 80 of doorbell devices from unexpected sources
- Pattern of /snapshot requests without preceding authentication
SIEM Query:
source_ip=* dest_ip=[doorbell_ip] dest_port=80 uri_path="/snapshot"