CVE-2023-30146

Vulnerability

The vulnerability resides in the backup retrieval endpoint of the web interface on the Assmann Digitus Plug&View IP Camera HT-IP211HDP running firmware version 2.000.022. The camera writes a compressed binary file containing the current settings, including administrator credentials stored in plaintext. This backup can be downloaded without any authentication, exposing sensitive data. The issue is described in reference [1] and affects cameras based on the HiSilicon H35xx SoC, but this CVE specifically covers the Assmann model.

Exploitation

An attacker with network access to the camera's web interface can exploit this by directly visiting the backup retrieval URL (e.g., /backup). No authentication or user interaction is required. The camera generates and serves the compressed backup file, which the attacker downloads. The file can be decompressed, and the plaintext administrator credentials can be read, allowing the attacker to log in as admin. A proof-of-concept script is scheduled for release per reference [1].

Impact

Successful exploitation yields the administrator credentials, granting full administrative control over the camera. This can lead to network compromise, as the attacker may use the camera as a pivot point for further attacks. The impact includes sensitive data exposure and potential unauthorized access to the local network.

Mitigation

As of the publication date (2023-08-04), no official patch has been released for this vulnerability. Reference [1] recommends ensuring that affected cameras cannot communicate with the internet and considering an upgrade to a newer device. The camera may be end-of-life. No workaround or fix is provided in the available references.