Lucene search

MitreCVE-2019-20467

HistoryJul 22, 2021 - 1:15 p.m.

CVE-2019-20467

2021-07-2213:15:08

mitre

web.nvd.nist.gov

sannce

smart hd

wifi security camera

ean 2 950004 595317

telnet

backdoor accounts

root access

code execution

vulnerability

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:L/Au:N/C:C/I:C/A:C

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

9.4

Confidence

High

EPSS

0.013

Percentile

86.1%

JSON

An issue was discovered on Sannce Smart HD Wifi Security Camera EAN 2 950004 595317 devices. The device by default has a TELNET interface available (which is not advertised or functionally used, but is nevertheless available). Two backdoor accounts (root and default) exist that can be used on this interface. The usernames and passwords of the backdoor accounts are the same on all devices. Attackers can use these backdoor accounts to obtain access and execute code as root within the device.

Affected configurations

Nvd

Node

sanncesmart_hd_wifi_security_camera_ean_2_950004_595317_firmwareMatch-

AND

sanncesmart_hd_wifi_security_camera_ean_2_950004_595317Match-

VendorProductVersionCPE
sanncesmart_hd_wifi_security_camera_ean_2_950004_595317_firmware-cpe:2.3:o:sannce:smart_hd_wifi_security_camera_ean_2_950004_595317_firmware:-:*:*:*:*:*:*:*
sanncesmart_hd_wifi_security_camera_ean_2_950004_595317-cpe:2.3:h:sannce:smart_hd_wifi_security_camera_ean_2_950004_595317:-:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
sannce	smart_hd_wifi_security_camera_ean_2_950004_595317_firmware	-	cpe:2.3:o:sannce:smart_hd_wifi_security_camera_ean_2_950004_595317_firmware:-:::::::*
sannce	smart_hd_wifi_security_camera_ean_2_950004_595317	-	cpe:2.3:h:sannce:smart_hd_wifi_security_camera_ean_2_950004_595317:-:::::::*

References

seclists.org/fulldisclosure/2024/Jul/14

www.eurofins-cybersecurity.com/news/connected-devices-baby-monitors-part-2/

www.sannce.com

Social References

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:L/Au:N/C:C/I:C/A:C

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

9.4

Confidence

High

EPSS

0.013

Percentile

86.1%

JSON

Related for CVE-2019-20467