search menu icon-carat-right cmu-wordmark

CERT Coordination Center


Zhuhai Raysharp firmware for DVRs from multiple vendors contains hard-coded credentials

Vulnerability Note VU#899080

Original Release Date: 2016-02-17 | Last Revised: 2016-02-19

Overview

Digital Video Recorders (DVRs), security cameras, and possibly other devices from multiple vendors use a firmware derived from Zhuhai RaySharp that contains a hard-coded root password.

Description

CWE-259: Use of Hard-coded Password - CVE-2015-8286

According to the reporter, DVR devices based on the Zhuhai RaySharp firmware contain a hard-coded root password. Remote attackers with knowledge of the password may gain root access to the device.

Furthermore, it was previously reported publicly that many of these devices enable remote access via telnet or port 9000 by default.

The CERT/CC has not been able to confirm this information directly with Zhuhai RaySharp. The Vendor List below provides more information on each manufacturer that was reported to be vulnerable.

The reporter, Risk Based Security, has provided security advisory RBS-2016-001 with more information.

Impact

An unauthenticated remote attacker may gain root access to the device.

Solution

Apply an update if possible

Some vendors have released updated firmware to address this issue. Please contact your device manufacturer for more information. The Vendor List below provides more information on each manufacturer that was reported to be vulnerable.

If your vendor does not have an updated firmware available at this time, you may consider the following mitigations:

Restrict network access

Use a firewall or similar technology to restrict access to trusted hosts, networks, and services.

Vendor Information

899080
Expand all

Swann

Notified:  September 22, 2015 Updated:  February 19, 2016

Statement Date:   February 19, 2016

Status

  Affected

Vendor Statement

"We are reaching out to Raysharp for firmware updates to further secure the older units but as the technology they were based on is now well and truly out of production this will take some time.

Until such time as Swann are able to secure updated firmware for these models we recommend that the units are disconnected from the user's network to prevent malicious access. If the user requires remote access to their unit then we recommend that the user changes the numbers of the internal network "Ports" to use non-standard values that are not easily discovered and make random access very difficult. Swann's Tech Center can help guide users through this process if necessary.
"

Vendor Information

We are not aware of further vendor information regarding this vulnerability.

Addendum

While some Swann models use Raysharp code, Swann has stated that they do not use the same default hard-coded credentials provided by Raysharp. However, the credentials are still hard-coded.

If you have feedback, comments, or additional information about this vulnerability, please send us email.

Zhuhai RaySharp

Notified:  September 09, 2015 Updated:  February 17, 2016

Status

  Affected

Vendor Statement

No statement is currently available from the vendor regarding this vulnerability.

Vendor Information

We are not aware of further vendor information regarding this vulnerability.

Addendum

There are no additional comments at this time.

If you have feedback, comments, or additional information about this vulnerability, please send us email.

Axis Communications

Notified:  February 09, 2016 Updated:  February 12, 2016

Statement Date:   February 12, 2016

Status

  Not Affected

Vendor Statement

"Axis does not use nor include any of the code or products [RaySharp] described".

Vendor Information

We are not aware of further vendor information regarding this vulnerability.

Addendum

There are no additional comments at this time.

If you have feedback, comments, or additional information about this vulnerability, please send us email.

Hanwha

Notified:  February 09, 2016 Updated:  February 12, 2016

Statement Date:   February 12, 2016

Status

  Not Affected

Vendor Statement

"Our product do not use firmware from Zhuhai RaySharp."

Vendor Information

We are not aware of further vendor information regarding this vulnerability.

Addendum

There are no additional comments at this time.

If you have feedback, comments, or additional information about this vulnerability, please send us email.

COP USA

Notified:  September 09, 2015 Updated:  February 17, 2016

Status

  Unknown

Vendor Statement

No statement is currently available from the vendor regarding this vulnerability.

Vendor Information

We are not aware of further vendor information regarding this vulnerability.

Addendum

There are no additional comments at this time.

If you have feedback, comments, or additional information about this vulnerability, please send us email.

CWD

Notified:  September 23, 2015 Updated:  February 17, 2016

Status

  Unknown

Vendor Statement

No statement is currently available from the vendor regarding this vulnerability.

Vendor Information

We are not aware of further vendor information regarding this vulnerability.

Addendum

CWD makes Defender-USA products.

If you have feedback, comments, or additional information about this vulnerability, please send us email.

KGuard Security

Notified:  September 09, 2015 Updated:  February 17, 2016

Status

  Unknown

Vendor Statement

No statement is currently available from the vendor regarding this vulnerability.

Vendor Information

We are not aware of further vendor information regarding this vulnerability.

Addendum

There are no additional comments at this time.

If you have feedback, comments, or additional information about this vulnerability, please send us email.

Konig Electronics

Notified:  September 23, 2015 Updated:  February 17, 2016

Status

  Unknown

Vendor Statement

No statement is currently available from the vendor regarding this vulnerability.

Vendor Information

We are not aware of further vendor information regarding this vulnerability.

Addendum

There are no additional comments at this time.

If you have feedback, comments, or additional information about this vulnerability, please send us email.

Lorex Corporation

Notified:  September 09, 2015 Updated:  February 17, 2016

Status

  Unknown

Vendor Statement

No statement is currently available from the vendor regarding this vulnerability.

Vendor Information

We are not aware of further vendor information regarding this vulnerability.

Addendum

There are no additional comments at this time.

If you have feedback, comments, or additional information about this vulnerability, please send us email.


CVSS Metrics

Group Score Vector
Base 10.0 AV:N/AC:L/Au:N/C:C/I:C/A:C
Temporal 8.5 E:POC/RL:U/RC:UR
Environmental 6.4 CDP:ND/TD:M/CR:ND/IR:ND/AR:ND

References

Credit

Thanks to Carsten Eiram of Risk Based Security for reporting these vulnerabilities.

This document was written by Garret Wassermann.

Other Information

CVE IDs: CVE-2015-8286
Date Public: 2016-02-17
Date First Published: 2016-02-17
Date Last Updated: 2016-02-19 19:49 UTC
Document Revision: 70

Sponsored by the Department of Homeland Security Office of Cybersecurity and Communications.