CVE-2022-31211
📋 TL;DR
Infiray IRAY-A8Z3 thermal cameras have a default blank root password for TELNET, allowing attackers to gain full administrative access. This affects all devices running firmware version 1.0.957 with default configurations. Attackers can completely compromise the device and potentially pivot to other network resources.
💻 Affected Systems
- Infiray IRAY-A8Z3 thermal camera
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete device takeover leading to camera manipulation, network pivoting, data exfiltration, and potential use as a foothold for broader network attacks.
Likely Case
Unauthorized access to camera controls, video feed interception, configuration changes, and device becoming part of a botnet.
If Mitigated
Limited to unsuccessful authentication attempts if proper password controls are implemented.
🎯 Exploit Status
Exploitation requires only TELNET access and knowledge of the default blank password. No special tools or skills needed.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: Not publicly available
Restart Required: No
Instructions:
No official patch available. Contact Infiray support for firmware updates and follow workaround steps.
🔧 Temporary Workarounds
Set Strong Root Password
allChange the default blank root password to a strong, unique password.
telnet [device_ip]
login: root
passwd
[enter new strong password]
Disable TELNET Service
linuxTurn off TELNET service if not required for operations.
telnet [device_ip]
login: root
service telnet stop
chkconfig telnet off
🧯 If You Can't Patch
- Network segmentation: Isolate cameras in separate VLAN with strict firewall rules
- Implement network access controls: Restrict TELNET access to management networks only
🔍 How to Verify
Check if Vulnerable:
Attempt TELNET connection to device port 23 with username 'root' and blank password. If login succeeds, device is vulnerable.Check Version:
telnet [device_ip] then check firmware version in web interface or via 'cat /etc/version' after loginVerify Fix Applied:
Attempt TELNET login with blank password - should fail. Verify strong password is required.📡 Detection & Monitoring
Log Indicators:
- Successful TELNET root login with blank password
- Multiple failed TELNET authentication attempts
Network Indicators:
- TELNET connections to camera devices
- Unusual outbound traffic from camera devices
SIEM Query:
source_port:23 AND (event_type:authentication_success OR authentication_failure)