CVE-2015-8286

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

Zhuhai RaySharp firmware has a hardcoded root password, which makes it easier for remote attackers to obtain access via a session on TCP port 23 or 9000.

Metrics

CVSS 3.0 9.8/10CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-254

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://console-cowboys.blogspot.com/2013/01/swann-song-dvr-insecurity.htmlExploit
http://seclists.org/bugtraq/2015/Jun/117Exploit
http://www.forbes.com/sites/andygreenberg/2013/01/28/more-than-a-dozen-brands-of-security-camera-systems-vulnerable-to-hacker-hijacking/
http://www.kb.cert.org/vuls/id/899080Third Party Advisory, US Government Resource
http://www.kb.cert.org/vuls/id/923388Third Party Advisory, US Government Resource
https://community.rapid7.com/community/metasploit/blog/2013/01/23/ray-sharp-cctv-dvr-password-retrieval-remote-root
http://console-cowboys.blogspot.com/2013/01/swann-song-dvr-insecurity.htmlExploit
http://seclists.org/bugtraq/2015/Jun/117Exploit
http://www.forbes.com/sites/andygreenberg/2013/01/28/more-than-a-dozen-brands-of-security-camera-systems-vulnerable-to-hacker-hijacking/
http://www.kb.cert.org/vuls/id/899080Third Party Advisory, US Government Resource
http://www.kb.cert.org/vuls/id/923388Third Party Advisory, US Government Resource
https://community.rapid7.com/community/metasploit/blog/2013/01/23/ray-sharp-cctv-dvr-password-retrieval-remote-root

Timeline

Published: Feb 18, 2016
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2015

CVE-2015-82875.3Swann SRNVW-470LCD devices with firmware through 0114 and SWNVW-470CAM devices with firmware through 1022 allow remote attackers to watch li CVE-2015-82885.9NETGEAR D3600 devices with firmware 1.0.0.49 and D6000 devices with firmware 1.0.0.49 and earlier use the same hardcoded private key across CVE-2015-82897.5The password-recovery feature on NETGEAR D3600 devices with firmware 1.0.0.49 and D6000 devices with firmware 1.0.0.49 and earlier allows re CVE-2015-82989.8Multiple SQL injection vulnerabilities in the login page in RXTEC RXAdmin UPDATE 06 / 2012 allow remote attackers to execute arbitrary SQL c CVE-2015-82999.8Buffer overflow in the Group messages monitor (Falcon) in KNX ETS 4.1.5 (Build 3246) allows remote attackers to execute arbitrary code via a CVE-2015-83007.8Polycom BToE Connector before 3.0.0 uses weak permissions (Everyone: Full Control) for "Program Files (x86)\polycom\polycom btoe connector\p CVE-2015-83034.0Huawei Document Security Management (DSM) with software before V100R002C05SPC661 does not clear the clipboard when closing a secure file, wh CVE-2015-83047.8Integer overflow in Huawei P7 phones with software before P7-L07 V100R001C01B606 allows remote attackers to gain privileges via a crafted ap CVE-2015-83055.5Huawei Sophia-L10 smartphones with software before P7-L10C900B852 allow attackers to cause a denial of service (system panic) via a crafted CVE-2015-83067.8Buffer overflow in the HIFI driver in Huawei P8 phones with software GRA-TL00 before GRA-TL00C01B230, GRA-CL00 before GRA-CL00C92B230, GRA-C CVE-2015-83077.8The Graphics driver in Huawei P8 smartphones with software GRA-TL00 before GRA-TL00C01B230, GRA-CL00 before GRA-CL00C92B230, GRA-CL10 before CVE-2015-83087.8LXDM before 0.5.2 did not start X server with -auth, which allows local users to bypass authentication with X connections.