3 Vulnerabilities Found on AvertX IP Cameras
Unit 42 disclosed three vulnerabilities (CVE-2020-11623/4/5) in AvertX HD838 and 438IR IP cameras; AvertX has released patches.
Palo Alto Networks Unit 42 researchers found three vulnerabilities in AvertX HD838 and 438IR outdoor surveillance cameras, which are rebranded Hikvision products: CVE-2020-11625 (user enumeration), CVE-2020-11624 (weak password requirements), and CVE-2020-11623 (exposed dangerous method/function). User enumeration responses facilitate brute-force attacks, the default admin credentials (admin/1234) are never enforced to change, and physical access to an exposed UART interface allows bootloader access and configuration modification. AvertX released a patch, removed the UART connector, and disabled the interface in the latest production batch.
- CVE-2020-11625 lets attackers enumerate valid usernames via differing login responses, enabling brute-force attacks.
- CVE-2020-11624 leaves default admin credentials (admin/1234) usable since password changes are never enforced.
- CVE-2020-11623 exposes a UART interface; physical access permits bootloader access, configuration reset, or bricking the device.
- AvertX released patches and removed the UART connector in newer production batches.
- Organizations
- Unit 42
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
CVE-2020-11624+2 related CVEs | An issue was discovered in AvertX Auto focus Night Vision HD Indoor/Outdoor IP Dome Camera HD838 and Night Vision HD Indoor/Outdoor Mini IP Bullet Camera HD438 | 9.8 group max | 1% | PoC |
From the original article
5 min read at unit42.paloaltonetworks.com
On February 24, 2020, Palo Alto Networks Unit 42 researchers found vulnerabilities present in AvertX IP cameras running the latest firmware. Three vulnerabilities were found in AvertX IP cameras with model number HD838 and 438IR, as confirmed by AvertX. These products are surveillance cameras intended to be used outdoors with infrared and object detection technology built-in.
By Asher Davila · unit42.paloaltonetworks.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.