Unfixed Critical Vulnerability In Millions of XiongMai Devices Disclosed
XiongMai, one of the biggest OEMs alongside Dahua and Hikvision, has suffered a critical vulnerability impacting millions of their devices.
This comes after XiongMai received universal criticism for the lack of security resulting in the Mirai botnet.
*******, ****** ***** *** *********, *** relatively ******* ***** * ******** *** for ********* ***************, ******** *** *** with * ****** ***** ******, ******* increasing *** ****.
****** **** ****, ** ****** **-******** ********** ********** **** ******** *************, *** ** ** ** *********** and *** **** ******* * ****** track ****** *** ********.
Default ********* *** ****** ******** ***** ******** *************
*** ********* ********************* * **.* ******** ************ *** ******* *** ****** ** administrator ****** ** *** ********** ******* through ******* ************* ***********, *** ********** undocumented "*******" **** *******. **** ***** that **** ******* ******* *** ******* administrator ********, *** ****** *** ***** be ******** ******** ***** *** "*******" account.
*** ******* ** *********** ********** ******* is ***** *** *** ******* ****** unsigned ********. *** ****** **** ** attacker *** **** ********* ******** ******* through *** ***** ***** *********.
************, *** ******:
********* ***
**********************()***** ***** *** ******* ****** *** device ** ***** *** ******* *** malicious ********.**** ********* ****** ** ******** ** persist ******* **** *** *******’ ***** memory. ****** ** *** ***** ****, it cannot ** ******* *** **** ** ********* *** ******.
*** ********* *** ************* (***-****-*****), **** ******* *********** ************* ****** ***** ** ******* ******* code ** ******, ******* ********** *** ******* ** is ********.
Who ** ********
********* ** ***'* **********, **** ************* impacts ******** ** *******, ******* ********'* XMEye ***** *******. ***** ***** ****** video ******* ** ****** **** **** NVRs, ******* ** ************ ** *****'* P2P ***** *** *********'* ***-******* ***** services.
*** ********** **** *** ******* ********, smaller ***** ***** *********.
* ***** **** *** ** **** of *** ******* ********:
Minimum ****** ** ******* ********** ******
***** ********* *** *** ******** **** in ******* ********** *************, *** **** directly ****** *** ****** ** *** budget *********. *******, *** ********** ****** could ** **** ******* ****** ***** markets.
Botnet ****
**** *****, ** **** **** *****, these ********** ******* *** ***** ****** disruption ** *** **** ******** ******* but****** ************* *******.
*** ****** **** ***** ******* **** be *********** *** **** ****** ******* is **** ****, ***** *** ****** of ******* *** *** *********** ** an ****** ***** *** *** ************* being ********* ** *** ******** ** them.
Extends *** ***** ******
******** *** * ******** ***** ****** of ************* ******. ********'* ******** ** publications **** ******** ** *** ***** bug *** ************ ***** ******. **** ****** *****, * ******* reseller ** ******** ************* *** * **** ***** **** contains ****** ************ ******** *******.
****, *** ***** **** * ********** identified ******** ************** **** **** ****** unpatched ** ***** ****** ********.
Not ****** ** ** **********
***** *** ********* ****** ** **** are ********** ** ** ********** *****, proponents ** ******* ************* ****** **** surely *** **** ** ******** **** there *** ************* **** * ***** track ****** **** *****, *** ***** of *** ********** ** *** ***.
** ************* *****. ****** ******* *** found. -*****
***** *** **** **.
“Not ****** ** ** **********
***** *** ********* ****** ** **** are ********** ** ** ********** *****, proponents ** ******* ************* ****** **** surely *** **** ** ******** **** there *** ************* **** * ***** track ****** **** *****, *** ***** of *** ********** ** *** ***.”
———————————————————————————————————-
** ******* ** *** **** ********* in *** *******, ******* **** ** evidence ** ******* * ****** **** encompassing *** ** ***** ****** **** a *** ** ****** ******* *** companies **** **** ******** ******** ******?
* ***** "******** ** *******" ***** qualify *** *** ********** **** *** well ******* *** *** *** **, and * ***** "***** ********"
** = **** ****** *** ** Military *****, ********* ** ********
** = **** ****** *** ** Military *****, ********* ** ********
* **** ****** ** ** ********* **** ** ***. ** ** simply ***** *** ***** ******* **** have ** **** **** ** ** military *****. ********* *** ***** ** because **** **** ***** ***** ***** teams *** *** ********* *******.
*** ** ******* ************* **** **** cyber ******** ******: **** ******** ** devices, **** ***** *****, ** ***-******.
*** ** ******* ************* **** **** cyber ******** ******: **** ******** ** devices, **** ***** *****, ** ***-******.
*** ** **** **** **** ***** simply **** * ********** *********** ** slap * ******* ** *** ******* and ** **** *** ** *** heat?
***********...
****: *** ******** **** ** *** “default” **** ** “********” (stored ** /***/******/********). The hash algorithm was reverse engineered before and is implemented on ******.Basically, ** ** * ****** ** . For complex passwords it should be more efficient to find a hash collision than to crack the password. Interestingly, the same hash algorithm is used in products from Dahua Technology. Possibly Xiongmai ****** **** ***** ** *** **** ********* ** **** ** *** ****** ********* *** *** **** ******* ***?
*** **** *** ******** **** ** exactly *** **** ** *****, **** the **** ** *** ******** **** is ****** *** **** ** ******** (maybe **** ****** '/***' ****** '/***') and ****** **** ********.
*********
*)*****://******.***/****/***/****/******/*****-*******-****.**#***
*)*****://******.***/****/***/****/******/*****-********-***.**#***
*** ******** **, *** ****** ***? Or ** ** ****** '****** ********* SoC ***' ;-)
******, ***** ***. *** ******* *******, thought ********* *********** **** ** ****. Its * ********** ***** **** *** tiresome ******* ******** **** *****.
***** **** *********** **** *** * split **** *****. * ***** *** their *** ****** ******* **** *****’*.
* ******* ********* *** ******** *** bathroom ****** ******, ***** ***.