CVE-2017-8225
CRITICAL EXPLOITED IN THE WILDWireless IP Camera (P2P) Firmware - Unauthenticated Credential Exposure via Empty Login Parameters
Title source: llmExploitation Summary
CVE-2017-8225 has been observed exploited in the wild (reported by VulnCheck KEV, InTheWild.io). EIP tracks 4 public exploits from researchers including PierreKimSec, K3ysTr0K3R, kienquoc102.
AI-analyzed exploit summary This exploit targets a command injection vulnerability in the GoAhead web server used in various IP cameras. It bypasses authentication to extract credentials and then executes arbitrary commands via crafted HTTP requests to achieve remote code execution.
Description
On Wireless IP Camera (P2P) WIFICAM devices, access to .ini files (containing credentials) is not correctly checked. An attacker can bypass authentication by providing an empty loginuse parameter and an empty loginpas parameter in the URI.
Exploits (4)
This exploit targets a command injection vulnerability in the GoAhead web server used in various IP cameras. It bypasses authentication to extract credentials and then executes arbitrary commands via crafted HTTP requests to achieve remote code execution.
This PoC exploits CVE-2017-8225, an information disclosure vulnerability in GoAhead-based Wireless IP Camera (P2P) WIFICAM devices. It retrieves credentials by accessing the /system.ini endpoint with empty login parameters, parsing binary data for usernames and passwords.
This repository contains a Python-based exploit for CVE-2017-8225, targeting vulnerable cameras with a GoAhead web server. It includes a scanner to identify vulnerable targets via Shodan and a brute-forcer to extract credentials from vulnerable devices.
This repository contains the RouterSploit framework, an exploitation toolkit for embedded devices, including exploits, scanners, and credential testing modules. The framework is designed to test and exploit vulnerabilities in routers and other embedded systems.
References (2)
Scores
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H