Zhuhai Raysharp firmware for DVRs from multiple vendors contains hard-coded credentials
Original Release date: 17 Feb 2016 | Last revised: 19 Feb 2016

Overview
Digital Video Recorders (DVRs), security cameras, and possibly other devices from multiple vendors use a firmware derived from Zhuhai RaySharp that contains a hard-coded root password.

Description

CWE-259: Use of Hard-coded Password – CVE-2015-8286
According to the reporter, DVR devices based on the Zhuhai RaySharp firmware contain a hard-coded root password. Remote attackers with knowledge of the password may gain root access to the device.Furthermore, it was previously reported publicly that many of these devices enable remote access via telnet or port 9000 by default.The CERT/CC has not been able to confirm this information directly with Zhuhai RaySharp.

The Vendor List below provides more information on each manufacturer that was reported to be vulnerable.The reporter, Risk Based Security, has provided security advisory RBS-2016-001 with more information.

Impact

An unauthenticated remote attacker may gain root access to the device.

Solution

Apply an update if possibleSome vendors have released updated firmware to address this issue. Please contact your device manufacturer for more information.

The Vendor List below provides more information on each manufacturer that was reported to be vulnerable.If your vendor does not have an updated firmware available at this time, you may consider the following mitigations:

Restrict network accessUse a firewall or similar technology to restrict access to trusted hosts, networks, and services.

Vendor Information (Learn More)
Vendor
Status
Date Notified
Date Updated
Swann
Affected
22 Sep 2015
19 Feb 2016
Zhuhai RaySharp
Affected
09 Sep 2015
17 Feb 2016
Axis Communications
Not Affected
08 Feb 2016
12 Feb 2016
Hanwha
Not Affected
08 Feb 2016
12 Feb 2016
COP USA
Unknown
09 Sep 2015
17 Feb 2016
CWD
Unknown
23 Sep 2015
17 Feb 2016
KGuard Security
Unknown
09 Sep 2015
17 Feb 2016
Konig Electronics
Unknown
23 Sep 2015
17 Feb 2016
Lorex Corporation
Unknown
09 Sep 2015
17 Feb 2016
If you are a vendor and your product is affected, let us know.
CVSS Metrics (Learn More)
Group
Score
Vector
Base
10.0
AV:N/AC:L/Au:N/C:C/I:C/A:C
Temporal
8.5
E:POC/RL:U/RC:UR
Environmental
6.4
CDP:ND/TD:M/CR:ND/IR:ND/AR:ND

References

Credit
Thanks to Carsten Eiram of Risk Based Security for reporting these vulnerabilities.
This document was written by Garret Wassermann.

Other Information
CVE IDs: CVE-2015-8286
Date Public: 17 Feb 2016
Date First Published: 17 Feb 2016
Date Last Updated: 19 Feb 2016
Document Revision: 70

Feedback
If you have feedback, comments, or additional information about this vulnerability, please send us email.