CVE-2020-6852

CACAGOO Cloud Storage Intelligent Camera TV-288ZD-2MP with firmware 3.4.2.0919 has weak authentication of TELNET access, leading to root privileges without any…

published April 2, 2020

CVSS
—
EPSS
2%
Percentile
84.0
In the wild
Unconfirmed
What it is

🚨 One woefully weak TELNET authentication lets anyone waltz into the system with full root privileges — no password required! 🔥 Imagine a restaurant where anyone can walk in, grab the chef's apron, and start cooking without anyone batting an eye. That's how insecure this camera's TELNET access is! An attacker could gain complete control over the camera, viewing sensitive data, changing settings, or even spying on you without your knowledge. This level of access is absolutely devastating to your privacy and security!

Put simply

Imagine a restaurant where anyone can walk in, grab the chef's apron, and start cooking without anyone batting an eye. That's how insecure this camera's TELNET access is! CVE-2020-6852 highlights a vulnerability in the CACAGOO Cloud Storage Intelligent Camera TV-288ZD-2MP, where weak authentication for TELNET allows unauthorized users to gain root access without any credentials.

What to do

An attacker could gain complete control over the camera, viewing sensitive data, changing settings, or even spying on you without your knowledge. This level of access is absolutely devastating to your privacy and security! To mitigate this issue, disable TELNET access on the camera and switch to more secure protocols like SSH. Additionally, check for firmware updates regularly to ensure you're always using the latest security patches. You've got this! Follow these steps, and your camera will be safer in no time. 🛡️

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.02421 · 84.0th percentile
Published
2020-04-02T14:49Z
EPSS history
Timeline
  • 02 APR 14:49Z
    CACAGOO Cloud Storage Intelligent Camera TV-288ZD-2MP with firmware 3.4.2.0919 has weak authentication of TELNET access, leading to root privileges without any…
    cvelistv5