Cybersecurity researchers have discovered that a popular internet-connected security camera is permanently vulnerable to a flaw that could allow threat actors to access recorded content and execute malicious code to further compromise the endpoint.
In a research report published earlier today, security firm Bitdefender states that its researchers started looking into the Wyze Cam IoT camera in 2019 and identified several vulnerabilities.
One of the bugs, tracked as CVE-2019-9564, is an authentication bypass, which allows threat actors to log into the device without knowing the login credentials.
Accessing the SD card
As the report explains, the vulnerability could be abused to take full control of the device, which includes the ability to change the direction it is facing, turn the camera on and off and disable recording to microSD card.
“We can’t view the live audio and video feed, though, because it is encrypted, and the value of ‘enr’ is unknown,” the researchers explained. “We can bypass this restriction by daisy-chaining a stack buffer overflow which leads to remote code execution.”
The remote control execution flaw, caused by a stack-based buffer overflow, is tracked as CVE-2019-12266. “When processing IOCtl with ID 0x2776, the device does not check whether the destination buffer is long enough before copying the contents on the stack,” the report reads. “Exploiting this vulnerability is straight-forward.”
When it comes to the unauthenticated access to the contents of the SD card, the researchers say it can be done via the webserver listening on port 80 without authentication.
“This is due to the fact that, after an SD card is inserted, a symlink to the card mount directory is automatically created in the www directory, which is served by the webserver.”
Although the report says both vulnerabilities were addressed through patches (one in September 2019, and the other in November 2020), it adds that “logistics and hardware limitations on the vendor’s side” resulted in the company discontinuing the version 1 of the product.
That leaves existing owners “in a permanent window of vulnerability”, the researchers explained, concluding that customers should abandon the hardware altogether as soon as possible.
