Overview
CVE-2020-36871 is a security vulnerability affecting ESCAM QD-900 WIFI HD cameras. This vulnerability allows an unauthenticated attacker to remotely download a compressed configuration backup file from the camera via the /web/cgi-bin/hi3510/backup.cgi endpoint. This backup file can contain sensitive information, including administrative credentials, which could lead to unauthorized access and further compromise of the camera and potentially the connected network.
Technical Details
The vulnerability resides in the lack of authentication and authorization checks on the /web/cgi-bin/hi3510/backup.cgi endpoint. A remote attacker can simply request this URL to trigger the generation and download of the configuration backup file. The configuration file is typically compressed, but once extracted, it can reveal sensitive settings and credentials. The HiSilicon Hi3510 chipset is commonly used in these types of cameras.
CVSS Analysis
Due to the lack of official CVSS scoring at the time of publication, a CVSS score is unavailable. However, based on the impact of the vulnerability, it would likely be classified as high severity. The ability to remotely obtain administrative credentials without authentication poses a significant risk.
Possible Impact
The successful exploitation of this vulnerability could have serious consequences:
- Full Camera Control: An attacker can gain complete control of the camera, allowing them to view live feeds, modify settings, and potentially use the camera as a pivot point to attack other devices on the network.
- Data Breach: Exposure of sensitive information stored within the camera’s configuration, potentially including Wi-Fi passwords and other network credentials.
- Botnet Recruitment: The compromised camera could be added to a botnet and used for malicious purposes, such as distributed denial-of-service (DDoS) attacks.
- Privacy Violation: Unauthorized access to video and audio feeds exposes individuals and organizations to serious privacy violations.
Mitigation and Patch Steps
Unfortunately, as of the last available information, there is no official patch or firmware update available from ESCAM to address this vulnerability. Therefore, the following mitigation steps are recommended:
- Isolate the Camera: Place the camera on a separate network segment or VLAN to limit the potential impact of a compromise.
- Firewall Restrictions: Restrict access to the camera from the public internet using a firewall. Only allow access from trusted IP addresses or networks, if remote access is absolutely necessary.
- Strong Passwords: If possible to change, immediately change the default administrative password to a strong, unique password that is difficult to guess.
- Disable Unnecessary Features: Disable any unnecessary features or services on the camera to reduce the attack surface.
- Monitor Network Traffic: Monitor network traffic for suspicious activity related to the camera.
- Consider Replacement: Given the lack of official support and patches, consider replacing the ESCAM QD-900 camera with a more secure alternative from a reputable vendor that provides regular security updates.
References
Packet Storm: ESCAM QD-900 Unauthenticated Configuration Disclosure
Exploit-DB: ESCAM QD-900 Unauthenticated Configuration Disclosure
VulnCheck: ESCAM QD-900 Unauthenticated Configuration Disclosure
