CVSS2
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
COMPLETE
Integrity Impact
COMPLETE
Availability Impact
COMPLETE
AV:N/AC:L/Au:N/C:C/I:C/A:C
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS
Percentile
94.0%
Digital Video Recorders (DVRs), security cameras, and possibly other devices from multiple vendors use a firmware derived from Zhuhai RaySharp that contains a hard-coded root password.
CWE-259**: Use of Hard-coded Password**** -**CVE-2015-8286
According to the reporter, DVR devices based on the Zhuhai RaySharp firmware contain a hard-coded root password. Remote attackers with knowledge of the password may gain root access to the device.
Furthermore, it was previously reported publicly that many of these devices enable remote access via telnet or port 9000 by default.
The CERT/CC has not been able to confirm this information directly with Zhuhai RaySharp. The Vendor List below provides more information on each manufacturer that was reported to be vulnerable.
The reporter, Risk Based Security, has provided security advisory RBS-2016-001 with more information.
An unauthenticated remote attacker may gain root access to the device.
Apply an update if possible
Some vendors have released updated firmware to address this issue. Please contact your device manufacturer for more information. The Vendor List below provides more information on each manufacturer that was reported to be vulnerable.
If your vendor does not have an updated firmware available at this time, you may consider the following mitigations:
Restrict network access
Use a firewall or similar technology to restrict access to trusted hosts, networks, and services.
899080
Filter by status: All Affected Not Affected Unknown
Filter by content: __ Additional information available
__ Sort by: Status Alphabetical
Expand all
Javascript is disabled. Click here to view vendors.
Notified: September 22, 2015 Updated: February 19, 2016
Statement Date: February 19, 2016
Affected
"`We are reaching out to Raysharp for firmware updates to further secure the older units but as the technology they were based on is now well and truly out of production this will take some time.
Until such time as Swann are able to secure updated firmware for these models we recommend that the units are disconnected from the user’s network to prevent malicious access. If the user requires remote access to their unit then we recommend that the user changes the numbers of the internal network “Ports” to use non-standard values that are not easily discovered and make random access very difficult. Swann’s Tech Center can help guide users through this process if necessary.`"
We are not aware of further vendor information regarding this vulnerability.
While some Swann models use Raysharp code, Swann has stated that they do not use the same default hard-coded credentials provided by Raysharp. However, the credentials are still hard-coded.
If you have feedback, comments, or additional information about this vulnerability, please send us [email](<mailto:[email protected]?Subject=VU%23899080 Feedback>).
Notified: September 09, 2015 Updated: February 17, 2016
Affected
We have not received a statement from the vendor.
We are not aware of further vendor information regarding this vulnerability.
Notified: February 09, 2016 Updated: February 12, 2016
Statement Date: February 12, 2016
Not Affected
“Axis does not use nor include any of the code or products [RaySharp] described”.
We are not aware of further vendor information regarding this vulnerability.
Notified: February 09, 2016 Updated: February 12, 2016
Statement Date: February 12, 2016
Not Affected
“Our product do not use firmware from Zhuhai RaySharp.”
We are not aware of further vendor information regarding this vulnerability.
Notified: September 09, 2015 Updated: February 17, 2016
Unknown
We have not received a statement from the vendor.
We are not aware of further vendor information regarding this vulnerability.
Notified: September 23, 2015 Updated: February 17, 2016
Unknown
We have not received a statement from the vendor.
We are not aware of further vendor information regarding this vulnerability.
CWD makes Defender-USA products.
If you have feedback, comments, or additional information about this vulnerability, please send us [email](<mailto:[email protected]?Subject=VU%23899080 Feedback>).
Notified: September 09, 2015 Updated: February 17, 2016
Unknown
We have not received a statement from the vendor.
We are not aware of further vendor information regarding this vulnerability.
Notified: September 23, 2015 Updated: February 17, 2016
Unknown
We have not received a statement from the vendor.
We are not aware of further vendor information regarding this vulnerability.
Notified: September 09, 2015 Updated: February 17, 2016
Unknown
We have not received a statement from the vendor.
We are not aware of further vendor information regarding this vulnerability.
Group | Score | Vector |
---|---|---|
Base | 10 | AV:N/AC:L/Au:N/C:C/I:C/A:C |
Temporal | 8.5 | E:POC/RL:U/RC:UR |
Environmental | 6.4 | CDP:ND/TD:M/CR:ND/IR:ND/AR:ND |
Thanks to Carsten Eiram of Risk Based Security for reporting these vulnerabilities.
This document was written by Garret Wassermann.
CVE IDs: | CVE-2015-8286 |
---|---|
Date Public: | 2016-02-17 Date First Published: |
CVSS2
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
COMPLETE
Integrity Impact
COMPLETE
Availability Impact
COMPLETE
AV:N/AC:L/Au:N/C:C/I:C/A:C
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS
Percentile
94.0%