The vulnerability occurs in the dtg_get_config.sh script due to improper handling of a user-controlled variable. To access this functionality, an attacker needs to know the secret path to the camera (for local attacks), or to obtain access to the user account (through credential stuffing, phishing etc.) to send commands using the VPN connection. The webserver running on the camera is vulnerable to a file write that can be leveraged to obtain command execution with the privileges of the running server. Jan 17, 2020: Patch is adopted among affected customersĪpr 23, 2020: Coordinated vulnerability disclosure Authenticated file write leading to command execution Jan 14, 2020: Vulnerability is fixed, patch expected to deploy on Jan 20 Disclosure timelineĭec 20, 2019: Bitdefender informs the vendor about the vulnerabilityĭec 23, 2019: Vulnerability acknowledged on the vendor’s side And, while we’ll let you imagine a valid real-world scenario in which you’d pwn your own device, we’d also like to remind keen visitors to our blog that the ability to jailbreak is still a vulnerability and should be regarded as such. While our past research showed real-life examples where attackers could remotely hijack devices and control them from afar, this report is a tad different – the vulnerabilities outlined here may help a legitimate user or a third party in possession of the correct credentials to jailbreak the device and completely own it. These might not be the droids you’re looking for The Bitdefender IoT Vulnerability Research Team discovered that the device is susceptible to an authenticated file write that leads to command execution (CVE-2019-17101), as well as to a privilege escalation via dirtyc0w – a local privilege escalation bug that exploits a race condition in the implementation of the copy-on-write mechanism in the kernel’s memory-management subsystem. More information is available in this article published on our partner’s website. PCMag contacted the research team at Bitdefender and asked us to look at several popular devices, including the Netatmo Smart Indoor Security Camera.

This article – part of a series developed in partnership with PCMag – aims to shed light on the security of the world’s best-sellers in the IoT space. Security cameras have become a necessity but, in the IoT world, any new gadget added to a network can turn into a liability. In public places, offices or private homes, video surveillance helps deter crime and detect accidents before they become uncontainable. Indoor video surveillance has become one of the most frequent applications for IoT devices. CVE-2019-17101 – Command execution due to unsanitized input

Reallife cams cracks