CVE-2023-38024CWE-798

SpotCam Co., Ltd. SpotCamFHD - Use of Hard-coded Cryptographic Key -1

Critical · published August 28, 2023

CVSS v3.1
9.8
EPSS
1%
Percentile
57.8
In the wild
Unconfirmed
What it is

🚨 A hidden Telnet function exposes the SpotCam FHD 2 like a locked door with a key left hanging on it! 🔥 Think of it as a secret room in a house where any visitor can waltz in and take whatever they want, simply because the door was always slightly ajar. It's a nasty surprise waiting to happen if someone stumbles upon those hard-coded credentials! An attacker could potentially walk straight into your system, performing arbitrary operations or disrupting your services, which could lead to a compromised camera feed or even take down your surveillance system. This is absolutely devastating for security, especially in homes or businesses relying on these cameras to keep an eye on things.

Put simply

Think of it as a secret room in a house where any visitor can waltz in and take whatever they want, simply because the door was always slightly ajar. It's a nasty surprise waiting to happen if someone stumbles upon those hard-coded credentials! This vulnerability stems from hard-coded Telnet credentials in the SpotCam FHD 2, allowing remote unauthenticated attackers to access and control the system without any prior authentication checks.

What to do

An attacker could potentially walk straight into your system, performing arbitrary operations or disrupting your services, which could lead to a compromised camera feed or even take down your surveillance system. This is absolutely devastating for security, especially in homes or businesses relying on these cameras to keep an eye on things. Immediately disable the Telnet functionality on your devices, check for any firmware updates from SpotCam, and ensure that any access credentials are changed to something secure. Regularly monitor your device for unauthorized access attempts after applying these changes. You've got this! Follow these steps to secure your device and keep your space safe! 🛡️

The record
Technical detail
CVSS v3.1
9.8 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00848 · 57.8th percentile
Weakness
CWE-798 · Use of Hard-coded Credentials
Published
2023-08-28T03:14Z
EPSS history
Timeline
  • 28 AUG 03:14Z
    SpotCam Co., Ltd. SpotCamFHD - Use of Hard-coded Cryptographic Key -1
    cvelistv5