Remote Code Execution via XMeye P2P Cloud in XiongMai IP Cameras, NVRs And DVRs
- An attacker can guess account IDs because they've been based on devices' sequential physical addresses (MACs);
- All new XMEye accounts use a default admin username of "admin" with no password;
- Users aren't prompted to change this default password during the account setup process;
- Even if the user has changed the XMEye admin account password, there is also a second hidden account with the username and password combo of default/tluafed; and finally
- Access to this account allows an attacker to trigger a firmware update because the firmware aren't signed.
XiongMai is an OEM company. Their products are not branded: Instead the company makes the camera and puts the brand/logo for their "partners".
The product are listed under the following "brands":
9Trading, Abowone, AHWVSE, ANRAN, ASECAM, Autoeye, AZISHN, A-ZONE, BESDER/BESDERSEC, BESSKY, Bestmo, BFMore, BOAVISION, BULWARK, CANAVIS, CWH, DAGRO, datocctv, DEFEWAY, digoo, DiySecurityCameraWorld, DONPHIA, ENKLOV, ESAMACT, ESCAM, EVTEVISION, Fayele, FLOUREON , Funi, GADINAN, GARUNK, HAMROL, HAMROLTE, Highfly, Hiseeu, HISVISION, HMQC, IHOMEGUARD, ISSEUSEE, iTooner, JENNOV, Jooan, Jshida, JUESENWDM, JUFENG, JZTEK, KERUI, KKMOON, KONLEN, Kopda, Lenyes, LESHP, LEVCOECAM, LINGSEE, LOOSAFE, MIEBUL, MISECU, Nextrend, OEM, OLOEY, OUERTECH, QNTSQ, SACAM, SANNCE, SANSCO, SecTec, Shell film, Sifvision / sifsecurityvision, smar, SMTSEC, SSICON, SUNBA, Sunivision, Susikum, TECBOX, Techage, Techege, TianAnXun, TMEZON, TVPSii, Unique Vision, unitoptek, USAFEQLO, VOLDRELI, Westmile, Westshine, Wistino, Witrue, WNK Security Technology, WOFEA, WOSHIJIA, WUSONLUSAN, XIAO MA, XinAnX, xloongx, YiiSPO, YUCHENG, YUNSYE, zclever, zilnk, ZJUXIN, zmodo, and ZRHUNTER.
If anyone owns any one of these internet-facing camera, DVR or NVR, please take them off the network.
If anyone wants to buy a "reasonably priced" internet camera, DVR or NVR, check first if it's using an XMEye account. If it is, walk away.
Hope this helps.
Already knew this was possible a long time ago, which is why I warned anyone who were going to buy the cheap CCTV camera on ebay to change the SSH password, and close unneeded ports etc.