Hard-Coded Credentials in JAIOTlink C492A-W6 IP Camera Firmware

Impact Analysis

Exploitation of this vulnerability can lead to unauthorized access to the camera's sensitive data and controls.

• Attackers can view camera snapshots and live video streams, compromising privacy and confidentiality.
• They can access and modify network configuration settings, potentially disrupting device connectivity or redirecting traffic.
• Attackers can interact with factory-level API endpoints, including the SetMAC command injection surface, which may allow further exploitation or control over the device.

Overall, this vulnerability poses risks to confidentiality, integrity, and availability of the device and its data.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by attempting to access the anyka_ipc HTTP service on port 80 of the Jaiotlink C492A-W6 Wi-Fi IP camera using the default admin username with an empty password.

A simple way to test this is to send an HTTP request with Basic Authentication using the username "admin" and no password to the camera's IP address on port 80 and check if access is granted.

For example, you can use the following curl command to test for unauthorized access:

• curl -v --user admin: http://<camera-ip>:80/

If the response allows access without a password, the device is vulnerable.

Additionally, scanning your network for devices with open port 80 running the anyka_ipc HTTP service and testing for default credentials can help detect vulnerable devices.

Useful 0 Not Useful 0

Executive Summary

The vulnerability affects JAIOTlink C492A-W6 Wi-Fi IP cameras running firmware 4.8.30.57701411. It involves hard-coded default credentials where the camera's HTTP service on port 80 accepts the username "admin" with an empty password. This allows an attacker on the same network to gain unauthorized access to the camera.

Using these default credentials, attackers can access sensitive features such as camera snapshots, video streams, network configuration, and factory-level API endpoints including a command injection surface called SetMAC.

The vulnerability arises because the default credentials are hardcoded and exposed, for example, in the companion Android app's code, making it easy for attackers to discover and exploit.

Useful 0 Not Useful 0

Mitigation Strategies

Immediate mitigation steps include removing or changing the default hard-coded credentials to unique, strong passwords to prevent unauthorized access.

Restrict access to the anyka_ipc HTTP service on port 80 by limiting network access to trusted users or isolating the camera on a separate network segment.

Avoid using the vulnerable firmware version 4.8.30.57701411 or earlier; update the device firmware if a patch or newer version is available.

Disable or restrict access to factory-level API endpoints, including the SetMAC command injection surface, especially in production environments.

If possible, remove hardcoded credentials from companion applications or avoid using such apps until the issue is resolved.

Useful 0 Not Useful 0