CVE-2017-8226

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

Amcrest IPM-721S V2.420.AC00.16.R.20160909 devices have default credentials that are hardcoded in the firmware and can be extracted by anyone who reverses the firmware to identify them. If the firmware version V2.420.AC00.16.R 9/9/2016 is dissected using binwalk tool, one obtains a _user-x.squashfs.img.extracted archive which contains the filesystem set up on the device that many of the binaries in the /usr folder. The binary "sonia" is the one that has the vulnerable function that sets up the default credentials on the device. If one opens this binary in IDA-pro, one will notice that this follows a ARM little endian format. The function sub_3DB2FC in IDA pro is identified to be setting up the values at address 0x003DB5A6. The sub_5C057C then sets this value and adds it to the Configuration files in /mnt/mtd/Config/Account1 file.

Metrics

CVSS 3.0 9.8/10CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-798

Affected software

No affected versions have been published.

Timeline

Published
Jul 3, 2019
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2017

CVE-2017-82279.8Amcrest IPM-721S V2.420.AC00.16.R.20160909 devices have a timeout policy to wait for 5 minutes in case 30 incorrect password attempts are deCVE-2017-82288.8Amcrest IPM-721S V2.420.AC00.16.R.20160909 devices mishandle reboots within the past two hours. Amcrest cloud services does not perform a thCVE-2017-82299.8Amcrest IPM-721S V2.420.AC00.16.R.20160909 devices allow an unauthenticated attacker to download the administrative credentials. If the firmCVE-2017-82308.8On Amcrest IPM-721S V2.420.AC00.16.R.20160909 devices, the users on the device are divided into 2 groups "admin" and "user". However, as a pCVE-2017-82337.8In a camera driver function in all Android releases from CAF using the Linux kernel, a bounds check is missing when writing into an array poCVE-2017-82347.8In all Android releases from CAF using the Linux kernel, an out of bounds access can potentially occur in a camera function.CVE-2017-82355.5In all Android releases from CAF using the Linux kernel, a memory structure in a camera driver is not properly protected.CVE-2017-82367.8In all Android releases from CAF using the Linux kernel, a buffer overflow vulnerability exists in an IPA driver.CVE-2017-82377.8In all Android releases from CAF using the Linux kernel, a buffer overflow vulnerability exists while loading a firmware image.CVE-2017-82387.8In all Android releases from CAF using the Linux kernel, a buffer overflow vulnerability exists in a camera function.CVE-2017-82395.5In all Android releases from CAF using the Linux kernel, userspace-controlled parameters for flash initialization are not sanitized potentiaCVE-2017-82407.8In all Android releases from CAF using the Linux kernel, a kernel driver has an off-by-one buffer over-read vulnerability.
CVE-2017-8226: Critical severity, CVSS 9.8 | Vulnix